CVE-2026-1527
undici is vulnerable to CRLF Injection via upgrade option
Résumé
undici is vulnerable to CRLF Injection via upgrade option
Description d'origine
La description telle que publiée par la source (souvent en anglais).
ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to:
- Inject arbitrary HTTP headers
- Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch)
The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters:
// lib/dispatcher/client-h1.js:1121
if (upgrade) {
header += connection: upgrade\r\nupgrade: ${upgrade}\r\n
}
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- BellSoft Alpaquita BELL-CVE-2026-1527 nodejs Corrigé dans: 20.20.2-r0
- Debian DEBIAN-CVE-2026-1527 node-undici
- Ubuntu UBUNTU-CVE-2026-1527 node-undici
Références
- advisory cna.openjsf.org
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com
- web hackerone.com