CVE-2022-31150
CRLF injection in request headers
Summary
CRLF injection in request headers
Original description
The description as published by the source.
undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate \r\n is a workaround for this issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-31150 node-undici Fixed in: 5.8.0+dfsg1+~cs18.9.16-1
- Ubuntu UBUNTU-CVE-2022-31150 node-undici
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- web github.com
- web hackerone.com