Skip to main content

Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVE-2026-1527

Medium
4.6/10

Summary

Impact: When an application passes user-controlled input to the upgrade option of "client.request()", an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary HTTP headers * Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch) The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters: "// lib/dispatcher/client-h1.js:1121 if (upgrade) { header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n` }" This issue affects undici versions prior to 6.24.0 and 7.x prior to 7.24.0.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • REQUIRED
  • LOW
  • LOW
  • NONE

CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

The software uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

References

Advisory Timeline

  • Published