Description
undici library does not protect host HTTP header from CRLF injection vulnerabilities.
Recommendation
Update the undici package to the latest compatible version. Followings are version details:
- Affected version(s): >= 2.0.0, < 5.19.1
- Patched version(s): 5.19.1
References
Related Issues
- Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type - CVE-2022-35948
- Undici has CRLF Injection in undici via `upgrade` option - CVE-2026-1527
- undici before v5.8.0 vulnerable to CRLF injection in request headers - CVE-2022-31150
- Astro has Full-Read SSRF in error rendering via Host: header injection - CVE-2026-25545
You might also like:
- Tags:
- npm
- undici
Anything's wrong? Let us know Last updated on February 24, 2023