CVE-2026-1527
published 2026-03-12CVE-2026-1527: ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject…
PriorityP426medium4.6CVSS 3.1
AVNACLPRLUIRSUCLILAN
EPSS
0.28%
19.7th percentile
ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to:
* Inject arbitrary HTTP headers
* Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch)
The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters:
// lib/dispatcher/client-h1.js:1121
if (upgrade) {
header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n`
}Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | node-undici | < node-undici 7.24.5+dfsg+~cs3.2.0-1 (forky) | node-undici 7.24.5+dfsg+~cs3.2.0-1 (forky) |
| nodejs | undici | < 6.28.0 | 6.28.0 |
| nodejs | undici | < 6.24.0 | 6.24.0 |
| nodejs | undici | >= 7.0.0 < 7.29.0 | 7.29.0 |
| nodejs | undici | >= 7.0.0 < 7.24.0 | 7.24.0 |
| nodejs | undici | >= 8.0.0 < 8.9.0 | 8.9.0 |
| undici | undici | < 6.24.0; 7.0.0 < 7.24.0 | 6.24.0; 7.0.0 < 7.24.0 |
| undici | undici | >= 0 < 6.28.0 | 6.28.0 |
| undici | undici | >= 0 < 6.24.0 | 6.24.0 |
| undici | undici | >= 7.0.0 < 7.29.0 | 7.29.0 |
| undici | undici | >= 7.0.0 < 7.24.0 | 7.24.0 |
| undici | undici | >= 8.0.0 < 8.9.0 | 8.9.0 |
CVSS provenance
nvdv3.14.6MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
ghsa5.3MEDIUM
osv4.6MEDIUM
vendor_redhat5.3MEDIUM
vendor_debian4.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
undici: undici: HTTP header injection via unvalidated blob-like body type property
vendor_redhat·2026-07-29·CVSS 5.3
CVE-2026-15157 [MEDIUM] CWE-93 undici: undici: HTTP header injection via unvalidated blob-like body type property
undici: undici: HTTP header injection via unvalidated blob-like body type property
undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request, stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is unaffected because it validates headers, but ecosystem libraries that build duck-typed blob sha
Red Hat
undici: Undici: HTTP header injection and request smuggling vulnerability
vendor_redhat·2026-03-12·CVSS 4.6
CVE-2026-1527 [MEDIUM] CWE-93 undici: Undici: HTTP header injection and request smuggling vulnerability
undici: Undici: HTTP header injection and request smuggling vulnerability
ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to:
* Inject arbitrary HTTP headers
* Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch)
The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters:
// lib/dispatcher/client-h1.js:1121
if (upgrade) {
header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n`
}
A flaw was found in undici, a Node.js HTTP/1.1 client. This vulnerability allows a remote attacker to inject malicious data into HTTP headers or prematurely end HTTP requests by
Debian
CVE-2026-1527: node-undici - ImpactWhen an application passes user-controlled input to the upgrade option of ...
vendor_debian·2026·CVSS 4.6
CVE-2026-1527 [MEDIUM] CVE-2026-1527: node-undici - ImpactWhen an application passes user-controlled input to the upgrade option of ...
ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary HTTP headers * Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch) The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters: // lib/dispatcher/client-h1.js:1121 if (upgrade) { header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n` }
Scope: local
bookworm: open
forky: resolved (fixed in 7.24.5+dfsg+~cs3.2.0-1)
sid: resolved (fixed in 7.24.5+dfsg+~cs3.2.0-1)
trixie: open
GHSA
undici vulnerable to CRLF Injection via blob-like body 'type' property
ghsa·2026-08-03·CVSS 5.3
CVE-2026-15157 [MEDIUM] CWE-93 undici vulnerable to CRLF Injection via blob-like body 'type' property
undici vulnerable to CRLF Injection via blob-like body 'type' property
### Impact
When an application passes a duck-typed blob-like body to undici's HTTP/1.1 dispatcher (via `request()`, `stream()`, `pipeline()`, or `dispatch()`) with a `.type` derived from untrusted input, an attacker can inject CRLF sequences (`\r\n`) to append arbitrary HTTP headers and potentially smuggle a second request past the upstream.
The vulnerable branch in `lib/dispatcher/client-h1.js` pushes `body.type` directly into the outgoing headers with no validation, while every other header path in undici goes through `isValidHeaderValue()`:
```javascript
} else if (util.isBlobLike(body) && request.contentType == null && body.type) {
headers.push('content-type', body.type) // bypasses isValidHeaderValue()
}
```
T
OSV
Undici has CRLF Injection in undici via `upgrade` option
osv·2026-03-13
CVE-2026-1527 [MEDIUM] Undici has CRLF Injection in undici via `upgrade` option
Undici has CRLF Injection in undici via `upgrade` option
### Impact
When an application passes user-controlled input to the `upgrade` option of `client.request()`, an attacker can inject CRLF sequences (`\r\n`) to:
1. Inject arbitrary HTTP headers
2. Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch)
The vulnerability exists because undici writes the `upgrade` value directly to the socket without validating for invalid header characters:
```javascript
// lib/dispatcher/client-h1.js:1121
if (upgrade) {
header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n`
}
```
### Patches
Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.
### Workarounds
Sanitize the `upgrade` option
GHSA
Undici has CRLF Injection in undici via `upgrade` option
ghsa·2026-03-13
CVE-2026-1527 [MEDIUM] CWE-93 Undici has CRLF Injection in undici via `upgrade` option
Undici has CRLF Injection in undici via `upgrade` option
### Impact
When an application passes user-controlled input to the `upgrade` option of `client.request()`, an attacker can inject CRLF sequences (`\r\n`) to:
1. Inject arbitrary HTTP headers
2. Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch)
The vulnerability exists because undici writes the `upgrade` value directly to the socket without validating for invalid header characters:
```javascript
// lib/dispatcher/client-h1.js:1121
if (upgrade) {
header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n`
}
```
### Patches
Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.
### Workarounds
Sanitize the `upgrade` option
OSV
CVE-2026-1527: ImpactWhen an application passes user-controlled input to the upgrade option of client
osv·2026-03-12·CVSS 4.6
CVE-2026-1527 [MEDIUM] CVE-2026-1527: ImpactWhen an application passes user-controlled input to the upgrade option of client
ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary HTTP headers * Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch) The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters: // lib/dispatcher/client-h1.js:1121 if (upgrade) { header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n` }
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-1527 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 4.6
CVE-2026-1527 [MEDIUM] CVE-2026-1527 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-1527 :
JavaScript vulnerability analysis and mitigation
ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to:
Inject arbitrary HTTP headers
connection: upgrade\r\nupgrade: ${upgrade}\r\n
}
Source : NVD
## 4.6
Score
Published March 12, 2026
Severity MEDIUM
CNA Score 4.6
Affected Technologies
JavaScript
Node.js
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.9
Exploitation Probability (EPSS) N/A
Affected packages and libraries
renovate
kibana-9.2
Sources
NVD
Chainguard Has Fix Added at: Mar 19, 2026
Debian 12, 13 Severity MEDIUM No Fix Added at: Mar 13, 2026
Debian 14 S
Bugzilla
CVE-2026-1527 nodejs22: Undici: HTTP header injection and request smuggling vulnerability [fedora-all]
bugzilla·2026-03-12·CVSS 4.6
CVE-2026-1527 [MEDIUM] CVE-2026-1527 nodejs22: Undici: HTTP header injection and request smuggling vulnerability [fedora-all]
CVE-2026-1527 nodejs22: Undici: HTTP header injection and request smuggling vulnerability [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-3b76d8047d (nodejs22-22.22.2-3.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-3b76d8047d
Bugzilla
CVE-2026-1527 undici: Undici: HTTP header injection and request smuggling vulnerability
bugzilla·2026-03-12·CVSS 4.6
CVE-2026-1527 [MEDIUM] CVE-2026-1527 undici: Undici: HTTP header injection and request smuggling vulnerability
CVE-2026-1527 undici: Undici: HTTP header injection and request smuggling vulnerability
ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to:
* Inject arbitrary HTTP headers
* Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch)
The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters:
// lib/dispatcher/client-h1.js:1121
if (upgrade) {
header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n`
}
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2026:7350 https://access.redhat.com/errata/RHSA-2026:7
Bugzilla
CVE-2026-1527 nodejs20: Undici: HTTP header injection and request smuggling vulnerability [fedora-all]
bugzilla·2026-03-12·CVSS 4.6
CVE-2026-1527 [MEDIUM] CVE-2026-1527 nodejs20: Undici: HTTP header injection and request smuggling vulnerability [fedora-all]
CVE-2026-1527 nodejs20: Undici: HTTP header injection and request smuggling vulnerability [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-9dc3a61ad8 (nodejs20-20.20.2-3.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-9dc3a61ad8
---
FEDORA-2026-9dc3a61ad8 has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-9dc3a61ad8`
You can provide feedback for this update here: https://b
2026-03-12
Published