CRLF Injection in Nodejs ‘undici’ via host

Description

undici library does not protect host HTTP header from CRLF injection vulnerabilities.

Recommendation

Update the undici package to the latest compatible version. Followings are version details:

• Affected version(s): >= 2.0.0, < 5.19.1
• Patched version(s): 5.19.1

References

• GHSA-5r9g-qh6m-jxff
• hackerone.com
• CVE-2023-23936
• CWE-74
• CWE-93
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• parse is vulnerable to prototype pollution - CVE-2025-57324
• Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline - CVE-2024-30260
• AngularJS improperly sanitizes SVG elements - CVE-2025-0716
• static-server Path Traversal vulnerability - CVE-2023-26152

Tags:

npm

undici