Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type

Description

=< [email protected] users are vulnerable to CRLF Injection on headers when using unsanitized input as request headers, more specifically, inside the content-type header.

Recommendation

Update the undici package to the latest compatible version. Followings are version details:

• Affected version(s): <= 5.8.1
• Patched version(s): 5.8.2

References

• GHSA-f772-66g8-q5h3
• CVE-2022-35948
• CWE-74
• CWE-93
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• CRLF Injection in Nodejs ‘undici’ via host - CVE-2023-23936
• undici before v5.8.0 vulnerable to CRLF injection in request headers - CVE-2022-31150
• Eta vulnerable to Code Injection via templates rendered with user-defined data - CVE-2022-25967
• Undici has CRLF Injection in undici via `upgrade` option - CVE-2026-1527

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

How do hackers hack websites?

Tags:

npm

undici