PT-2026-25066 · Undici+1 · Undici+1
Matteo Collina
+1
·
Published
2026-03-12
·
Updated
2026-05-18
·
CVE-2026-1527
CVSS v3.1
4.6
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
undici versions prior to 7.24.0 and prior to 6.24.0
Description
The issue arises when an application passes user-controlled input to the
upgrade option of the client.request() function. This allows an attacker to inject CRLF (Carriage Return Line Feed) sequences (r ) to inject arbitrary HTTP headers or prematurely terminate HTTP requests, potentially smuggling raw data to non-HTTP services like Redis, Memcached, and Elasticsearch. The root cause is that undici writes the upgrade value directly to the socket without validating for invalid header characters. The vulnerable code is located in lib/dispatcher/client-h1.js at line 1121.Recommendations
Upgrade to undici version 7.24.0 or later.
Upgrade to undici version 6.24.0 or later.
Sanitize the
upgrade option string before passing it to undici to prevent the injection of CRLF sequences. For example, use a function to check for and reject values containing r or .Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Rocky Linux
Undici