The undici HTTP/1.1 dispatcher improperly handles the '.type' property of duck-typed blob-like bodies by directly inserting it into outgoing HTTP headers without validation. This allows attackers controlling the '.type' property to inject CRLF sequences, enabling HTTP header injection and potentially request smuggling. The vulnerability affects undici versions prior to 6.28.0, versions from 7.0.0 up to 7.29.0, and versions from 8.0.0 up to 8.9.0. Native Blob objects are safe because their constructors sanitize the '.type' property. The issue was patched by adding validation via isValidHeaderValue() in the affected code path. Workarounds include setting an explicit validated content-type header, using native Blob objects, rejecting control characters in the MIME type, or using fetch() APIs instead of non-fetch undici APIs.

An attacker able to supply a crafted duck-typed blob-like body with a malicious '.type' property can inject CRLF sequences into HTTP headers, potentially appending arbitrary headers and smuggling a second HTTP request past upstream servers. This can lead to HTTP request smuggling attacks, which may bypass security controls or cause unintended behavior. The impact is limited to scenarios where untrusted input controls the '.type' property of a blob-like body passed to undici's HTTP/1.1 dispatcher. The CVSS score is 4.2 (medium severity) reflecting limited impact and attack complexity.

A patch is available and users should upgrade to undici versions 6.28.0, 7.29.0, 8.9.0, or later. If upgrading is not immediately possible, mitigations include setting an explicit, validated content-type header on requests to bypass the vulnerable code path, using native Blob objects or fetch-blob which sanitize the '.type' property, rejecting control characters in the MIME type before assigning it to '.type', or using the fetch() API instead of undici's non-fetch APIs. These mitigations prevent injection of CRLF sequences via the '.type' property.