VYPR
← All advisories
Moderate severityNVD Advisory· Published Mar 12, 2026· Updated Mar 13, 2026

undici is vulnerable to CRLF Injection via upgrade option

CVE-2026-1527

Description

ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to:

* Inject arbitrary HTTP headers * Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch) The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters:

// lib/dispatcher/client-h1.js:1121 if (upgrade) { header += connection: upgrade\r\nupgrade: ${upgrade}\r\n }

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
undicinpm
< 6.24.06.24.0
undicinpm
>= 7.0.0, < 7.24.07.24.0

Affected products

49

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.