Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type

Description

=< [email protected] users are vulnerable to CRLF Injection on headers when using unsanitized input as request headers, more specifically, inside the content-type header.

Recommendation

Update the undici package to the latest compatible version. Followings are version details:

• Affected version(s): <= 5.8.1
• Patched version(s): 5.8.2

References

• GHSA-f772-66g8-q5h3
• CVE-2022-35948
• CWE-74
• CWE-93
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• The AuthKit Remix Library renders sensitive auth data in HTML - CVE-2025-55009
• Strapi allows Server-Side Request Forgery in Webhook function - CVE-2024-52588
• undici Denial of Service attack via bad certificate data - CVE-2025-47279
• Redoc Prototype Pollution via `Module.mergeObjects` Component - CVE-2024-57083

Tags:

npm

undici