CVE-2026-1527
undici is vulnerable to CRLF Injection via upgrade option
- State
- Published
- Severity
- 4.6 Medium
- Published
- Mar 12, 2026
- Updated
- Mar 13, 2026
- Reserved
- Jan 28, 2026
Description
ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to:
* Inject arbitrary HTTP headers * Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch) The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters:
// lib/dispatcher/client-h1.js:1121 if (upgrade) { header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n` }
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.6 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N | openjs |
Weaknesses
- CWE-93 Improper neutralization of CRLF sequences ('CRLF injection')
Affected Products
| Product | Versions |
|---|---|
undiciundici |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.