Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type

Description

=< [email protected] users are vulnerable to CRLF Injection on headers when using unsanitized input as request headers, more specifically, inside the content-type header.

Recommendation

Update the undici package to the latest compatible version. Followings are version details:

• Affected version(s): <= 5.8.1
• Patched version(s): 5.8.2

References

• GHSA-f772-66g8-q5h3
• CVE-2022-35948
• CWE-74
• CWE-93
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• CRLF Injection in Nodejs ‘undici’ via host - CVE-2023-23936
• undici before v5.8.0 vulnerable to CRLF injection in request headers - CVE-2022-31150
• create-choo-app3 is vulnerable to Command Injection via the devInstall function - CVE-2022-25855
• Matrix-appservice-irc vulnerable to sql injection via roomIds argument - CVE-2022-3971

Tags:

npm

undici