GHSA-4992-7rv2-5pvq

Опубликовано: 13 мар. 2026

Источник: github

Github: Прошло ревью

CVSS3: 4.6

Описание

Undici has CRLF Injection in undici via upgrade option

Impact

When an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to:

Inject arbitrary HTTP headers
Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch)

The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters:

// lib/dispatcher/client-h1.js:1121 if (upgrade) { header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n` }

Patches

Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.

Workarounds

Sanitize the upgrade option string before passing to undici:

function sanitizeUpgrade(value) { if (/[\r\n]/.test(value)) { throw new Error('Invalid upgrade value') } return value } client.request({ upgrade: sanitizeUpgrade(userInput) })

Ссылки

Пакеты

Наименование

undici

npm

Затронутые версииВерсия исправления

< 6.24.0

6.24.0

Наименование

undici

npm

Затронутые версииВерсия исправления

>= 7.0.0, < 7.24.0

7.24.0

EPSS

Процентиль: 17%

0.00256

Низкий

4.6 Medium

CVSS3

CVE ID

CVE-2026-1527

Дефекты

CWE-93

Связанные уязвимости

CVE-2026-1527

CVSS3: 4.6

ubuntu

5 месяцев назад

ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary HTTP headers * Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch) The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters: // lib/dispatcher/client-h1.js:1121 if (upgrade) { header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n` }