GitHub Advisoryadvisory · npm
GHSA-4992-7rv2-5pvq Undici has CRLF Injection in undici via `upgrade` option
MEDIUM
Official page ↗
- Aliases
- CVE-2026-1527
- Ecosystem
- npm
- Packages
- undici
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-93
- Reviewed
- 2026-03-13
Affected packages
• npm undici: < 6.24.0 → fixed in 6.24.0
• npm undici: >= 7.0.0, < 7.24.0 → fixed in 7.24.0
Description
Impact
When an application passes user-controlled input to the `upgrade` option of `client.request()`, an attacker can inject CRLF sequences (`\r\n`) to:
1. Inject arbitrary HTTP headers
2. Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch)
The vulnerability exists because undici writes the `upgrade` value directly to the socket without validating for invalid header characters:
```javascript
// lib/dispatcher/client-h1.js:1121
if (upgrade) {
header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n`
}
```
Patches
Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.
Workarounds
Sanitize the `upgrade` option string before passing to undici:
```javascript
function sanitizeUpgrade(value) {
if (/[\r\n]/.test(value)) {
throw new Error('Invalid upgrade value')
}
return value
}
client.request({
upgrade: sanitizeUpgrade(userInput)
})
```
Related
Alias · CVE (1)
- CVE-2026-1527 ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences… vulnerability
Weakness · CWE (1)
- CWE-93 Improper Neutralization of CRLF Sequences weakness