CVE-2026-1527
MEDIUM4.6EPSS 0.01%Undici has CRLF Injection in undici via `upgrade` option
Description
### Impact When an application passes user-controlled input to the `upgrade` option of `client.request()`, an attacker can inject CRLF sequences (`\r\n`) to: 1. Inject arbitrary HTTP headers 2. Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch) The vulnerability exists because undici writes the `upgrade` value directly to the socket without validating for invalid header characters: ```javascript // lib/dispatcher/client-h1.js:1121 if (upgrade) { header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n` } ``` ### Patches Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later. ### Workarounds Sanitize the `upgrade` option string before passing to undici: ```javascript function sanitizeUpgrade(value) { if (/[\r\n]/.test(value)) { throw new Error('Invalid upgrade value') } return value } client.request({ upgrade: sanitizeUpgrade(userInput) }) ```
Affected packages (2)
- Debian/node-undicifrom 0
- npm/undicifrom 0, < 6.24.0
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM4.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N |
References (6)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-1527
- ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2026-1527
- PATCHhttps://github.com/nodejs/undici
- WEBhttps://cna.openjsf.org/security-advisories.html
- WEBhttps://github.com/nodejs/undici/security/advisories/GHSA-4992-7rv2-5pvq
- WEBhttps://hackerone.com/reports/3487198