Sign in
Deutsch English Español Polski
Medium

Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type

  • Disclosed: 18.08.2022
  • Updated: 11.10.2026 10:22

Impact

=< undici@5.8.0 users are vulnerable to CRLF Injection on headers when using unsanitized input as request headers, more specifically, inside the content-type header.

Example:

js
import { request } from 'undici'

const unsanitizedContentTypeInput =  'application/json\r\n\r\nGET /foo2 HTTP/1.1'

await request('http://localhost:3000, {
    method: 'GET',
    headers: {
      'content-type': unsanitizedContentTypeInput
    },
})

The above snippet will perform two requests in a single request API call:

  1. http://localhost:3000/
  2. http://localhost:3000/foo2

Patches

This issue was patched in Undici v5.8.1

Workarounds

Sanitize input when sending content-type headers using user input.

For more information

If you have any questions or comments about this advisory:

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package undici < 5.8.2 5.8.2

References

CVSS score 5.3/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness (CWE)
CWE-74, CWE-93
Platform
npm
Package
undici
Disclosed
18.08.2022
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-f772-66g8-q5h3 - CC BY 4.0

Vulnerability history: undici

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (46) in the archive
Total entries
46
First → latest
06.2022 09.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • High 13
  • Medium 21
  • Low 12

Disclosures per year

Severity:
  1. undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
    High · 7.5 CVE-2026-19534 >= 6.7.0, < 6.28.1, >= 7.0.0, < 7.29.1, >= 8.0.0, < 8.10.2 6.28.1, 7.29.1, 8.10.2
  2. undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool
    High · 7.4 CVE-2026-84961 >= 7.24.1, < 7.29.1, >= 8.0.0, < 8.10.2 7.29.1, 8.10.2
  3. undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors
    High · 7.4 CVE-2026-85152 >= 8.10.0, < 8.10.2 8.10.2
  4. undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
    High · 7.4 CVE-2026-13697 >= 7.0.0, < 7.29.0, >= 8.0.0, < 8.9.0 7.29.0, 8.9.0
  5. undici WebSocket client vulnerable to denial of service via fragment count bypass
    High · 7.5 CVE-2026-12151 < 6.27.0, >= 7.0.0, < 7.28.0, >= 8.0.0, < 8.5.0 6.27.0, 7.28.0, 8.5.0
  6. undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse
    High · 7.5 CVE-2026-6734 >= 7.23.0, < 7.28.0, >= 8.0.0, < 8.2.0 7.28.0, 8.2.0
  7. undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
    High · 7.4 CVE-2026-9697 >= 7.23.0, < 7.28.0, >= 8.0.0, < 8.5.0 7.28.0, 8.5.0
  8. undici WebSocket client vulnerable to denial of service via cumulative fragment bypass
    High · 7.5 CVE-2026-9675 >= 8.0.0, < 8.5.0 8.5.0
  9. Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression
    High · 7.5 CVE-2026-1526 < 6.24.0, >= 7.0.0, < 7.24.0 6.24.0, 7.24.0
  10. Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation
    High · 7.5 CVE-2026-2229 < 6.24.0, >= 7.0.0, < 7.24.0 6.24.0, 7.24.0
  11. Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client
    High · 7.5 CVE-2026-1528 >= 6.0.0, < 6.24.0, >= 7.0.0, < 7.24.0 6.24.0, 7.24.0
  12. Regular Expression Denial of Service in Headers
    High · 7.5 CVE-2023-24807 < 5.19.1 5.19.1
  13. Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type this entry
    Medium · 5.3 CVE-2022-35948 < 5.8.2 5.8.2
  14. ProxyAgent vulnerable to MITM
    High · 7.7 CVE-2022-32210 >= 4.8.2, < 5.5.1 5.5.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.