Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type

Description

=< [email protected] users are vulnerable to CRLF Injection on headers when using unsanitized input as request headers, more specifically, inside the content-type header.

Recommendation

Update the undici package to the latest compatible version. Followings are version details:

• Affected version(s): <= 5.8.1
• Patched version(s): 5.8.2

References

• GHSA-f772-66g8-q5h3
• CVE-2022-35948
• CWE-74
• CWE-93
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect - CVE-2024-30261
• XSS in the `of` option of the `.position()` util in jquery-ui - CVE-2021-41184
• The AuthKit Remix Library renders sensitive auth data in HTML - CVE-2025-55009
• NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies - CVE-2025-48947

Tags:

npm

undici