CVE-2026-1527

Summary

ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to:

  • Inject arbitrary HTTP headers
  • Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch) The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters:

// lib/dispatcher/client-h1.js:1121 if (upgrade) { header += connection: upgrade\r\nupgrade: ${upgrade}\r\n }

Affected Software

VendorProductVersion RangeStatus
undiciundici< 6.24.0; 7.0.0 < 7.24.0affected
undiciundici6.24.0: 7.24.0unaffected

Weaknesses

  • CWE-93: CWE-93 Improper neutralization of CRLF sequences ('CRLF injection')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References