{
  "canonical_id": "undici--CVE-2026-1527",
  "system_id": "undici",
  "display_name": "Undici",
  "category": "frameworks",
  "advisory_mode": "core",
  "title": "Undici has CRLF Injection in undici via `upgrade` option",
  "summary": "### Impact\n\nWhen an application passes user-controlled input to the `upgrade` option of `client.request()`, an attacker can inject CRLF sequences (`\\r\\n`) to:\n\n1. Inject arbitrary HTTP headers\n2. Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch)\n\nThe vulnerability exists because undici writes the `upgrade` value directly to the socket without validating for invalid header characters:\n\n```javascript\n// lib/dispatcher/client-h1.js:1121\nif (upgrade) {\n  header += `connection: upgrade\\r\\nupgrade: ${upgrade}\\r\\n`\n}\n```\n\n### Patches\n\n Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.\n\n### Workarounds\n\nSanitize the `upgrade` option string before passing to undici:\n\n```javascript\nfunction sanitizeUpgrade(value) {\n  if (/[\\r\\n]/.test(value)) {\n    throw new Error('Invalid upgrade value')\n  }\n  return value\n}\n\nclient.request({\n  upgrade: sanitizeUpgrade(userInput)\n})\n```",
  "published_at": "2026-03-13T20:41:26Z",
  "updated_at": "2026-03-13T20:54:25.572106Z",
  "severity": "low",
  "cvss_score": 3.1,
  "exploit_status": "unknown",
  "source_confidence": "official",
  "official_source_url": "https://github.com/nodejs/undici/security/advisories/GHSA-4992-7rv2-5pvq",
  "secondary_source_urls": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-1527",
    "https://hackerone.com/reports/3487198",
    "https://cna.openjsf.org/security-advisories.html",
    "https://github.com/nodejs/undici"
  ],
  "aliases": [
    "CVE-2026-1527",
    "GHSA-4992-7rv2-5pvq"
  ],
  "cve_ids": [
    "CVE-2026-1527"
  ],
  "ghsa_ids": [
    "GHSA-4992-7rv2-5pvq"
  ],
  "osv_ids": [
    "GHSA-4992-7rv2-5pvq"
  ],
  "affected_versions": [
    "introduced=0, fixed<6.24.0",
    "introduced=7.0.0, fixed<7.24.0"
  ],
  "fixed_versions": [
    "6.24.0",
    "7.24.0"
  ],
  "package_name": "undici",
  "render_markdown": true,
  "case_path": "07-framework-security/frameworks/undici/cases/undici-cve-2026-1527.md",
  "secure_code_topics": [
    "ssrf-url-validation",
    "proxy-trust-boundary"
  ],
  "status": "generated",
  "triage_reasons": [],
  "metadata": {
    "source_names": [
      "OSV Undici"
    ],
    "source_kinds": [
      "osv-batch"
    ],
    "candidate_count": 1
  }
}