CVE-2026-1527
undici is vulnerable to CRLF Injection via upgrade option
Summary
undici is vulnerable to CRLF Injection via upgrade option
Original description
The description as published by the source.
ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to:
- Inject arbitrary HTTP headers
- Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch)
The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters:
// lib/dispatcher/client-h1.js:1121
if (upgrade) {
header += connection: upgrade\r\nupgrade: ${upgrade}\r\n
}
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- BellSoft Alpaquita BELL-CVE-2026-1527 nodejs Fixed in: 20.20.2-r0
- Debian DEBIAN-CVE-2026-1527 node-undici
- Ubuntu UBUNTU-CVE-2026-1527 node-undici
References
- advisory cna.openjsf.org
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com
- web hackerone.com