Количество 11
Количество 11
GHSA-4992-7rv2-5pvq
Undici has CRLF Injection in undici via `upgrade` option
CVE-2026-1527
ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary HTTP headers * Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch) The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters: // lib/dispatcher/client-h1.js:1121 if (upgrade) { header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n` }
CVE-2026-1527
ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary HTTP headers * Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch) The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters: // lib/dispatcher/client-h1.js:1121 if (upgrade) { header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n` }
CVE-2026-1527
ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary HTTP headers * Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch) The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters: // lib/dispatcher/client-h1.js:1121 if (upgrade) { header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n` }
CVE-2026-1527
ImpactWhen an application passes user-controlled input to theupgradeop ...
RLSA-2026:7670
Important: nodejs:24 security update
ELSA-2026-7670
ELSA-2026-7670: nodejs:24 security update (IMPORTANT)
RLSA-2026:7675
Important: nodejs24 security update
RLSA-2026:7350
Important: nodejs:24 security update
ELSA-2026-7675
ELSA-2026-7675: nodejs24 security update (IMPORTANT)
ELSA-2026-7350
ELSA-2026-7350: nodejs:24 security update (IMPORTANT)
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
| GHSA-4992-7rv2-5pvq Undici has CRLF Injection in undici via `upgrade` option | CVSS3: 4.6 | 0% Низкий | 5 месяцев назад |
 | CVE-2026-1527 ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary HTTP headers * Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch) The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters: // lib/dispatcher/client-h1.js:1121 if (upgrade) { header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n` } | CVSS3: 4.6 | 0% Низкий | 5 месяцев назад |
 | CVE-2026-1527 ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary HTTP headers * Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch) The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters: // lib/dispatcher/client-h1.js:1121 if (upgrade) { header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n` } | CVSS3: 6.5 | 0% Низкий | 5 месяцев назад |
 | CVE-2026-1527 ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary HTTP headers * Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch) The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters: // lib/dispatcher/client-h1.js:1121 if (upgrade) { header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n` } | CVSS3: 4.6 | 0% Низкий | 5 месяцев назад |
| CVE-2026-1527 ImpactWhen an application passes user-controlled input to theupgradeop ... | CVSS3: 4.6 | 0% Низкий | 5 месяцев назад |
 | RLSA-2026:7670 Important: nodejs:24 security update | 4 месяца назад | ||
| ELSA-2026-7670 ELSA-2026-7670: nodejs:24 security update (IMPORTANT) | 4 месяца назад | ||
| RLSA-2026:7675 Important: nodejs24 security update | 4 месяца назад | ||
| RLSA-2026:7350 Important: nodejs:24 security update | 4 месяца назад | ||
| ELSA-2026-7675 ELSA-2026-7675: nodejs24 security update (IMPORTANT) | около 2 месяцев назад | ||
| ELSA-2026-7350 ELSA-2026-7350: nodejs:24 security update (IMPORTANT) | 4 месяца назад |
Уязвимостей на страницу