{"id":"CVE-2026-1527","state":"PUBLISHED","title":"undici is vulnerable to CRLF Injection via upgrade option","description":"ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\\r\\n) to:\n\n  *  Inject arbitrary HTTP headers\n  *  Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch)\nThe vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters:\n\n// lib/dispatcher/client-h1.js:1121\nif (upgrade) {\n  header += `connection: upgrade\\r\\nupgrade: ${upgrade}\\r\\n`\n}","publishedAt":"2026-03-12T20:17:18.984Z","updatedAt":"2026-03-13T18:06:03.794Z","severity":{"score":4.6,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","source":"openjs"},"assigner":"openjs","products":["undici undici"],"affected":[{"vendor":"undici","product":"undici","packageName":"undici","defaultStatus":"unaffected","versions":[{"version":"< 6.24.0; 7.0.0 < 7.24.0","status":"affected"},{"version":"6.24.0: 7.24.0","status":"unaffected"}],"collectionURL":"https://github.com/nodejs/undici/","repo":"https://github.com/nodejs/undici/"}],"references":["https://github.com/nodejs/undici/security/advisories/GHSA-4992-7rv2-5pvq","https://hackerone.com/reports/3487198","https://cna.openjsf.org/security-advisories.html"],"weaknesses":["CWE-93"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/1xxx/CVE-2026-1527.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-1527","state":"PUBLISHED","datePublished":"2026-03-12T20:17:18.984Z","dateUpdated":"2026-03-13T18:06:03.794Z","assignerShortName":"openjs","assignerOrgId":"ce714d77-add3-4f53-aff5-83d477b104bb","dateReserved":"2026-01-28T12:05:08.491Z"},"containers":{"cna":{"title":"undici is vulnerable to CRLF Injection via upgrade option","descriptions":[{"lang":"en","value":"ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\\r\\n) to:\n\n  *  Inject arbitrary HTTP headers\n  *  Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch)\nThe vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters:\n\n// lib/dispatcher/client-h1.js:1121\nif (upgrade) {\n  header += `connection: upgrade\\r\\nupgrade: ${upgrade}\\r\\n`\n}"}],"affected":[{"vendor":"undici","product":"undici","packageName":"undici","defaultStatus":"unaffected","versions":[{"version":"< 6.24.0; 7.0.0 < 7.24.0","status":"affected"},{"version":"6.24.0: 7.24.0","status":"unaffected"}],"collectionURL":"https://github.com/nodejs/undici/","repo":"https://github.com/nodejs/undici/"}],"references":[{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-4992-7rv2-5pvq"},{"url":"https://hackerone.com/reports/3487198"},{"url":"https://cna.openjsf.org/security-advisories.html"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseSeverity":"MEDIUM","baseScore":4.6,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-93","lang":"en","description":"CWE-93 Improper neutralization of CRLF sequences ('CRLF injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"openjs","orgId":"ce714d77-add3-4f53-aff5-83d477b104bb","dateUpdated":"2026-03-12T20:17:18.984Z"},"credits":[{"lang":"en","value":"Matteo Collina","type":"remediation developer"},{"lang":"en","value":"Ulises Gascón","type":"remediation developer"},{"lang":"en","value":"Raul Vega del Valle","type":"analyst"}],"source":{"advisory":"GHSA-4992-7rv2-5pvq","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-03-13T18:05:24.550959Z","id":"CVE-2026-1527","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-13T18:06:03.794Z"}}]}}}