CVSS 3.1
4.6 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:NCVE-2026-1527
Medium (4.6) in nodejs undici. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in undici 6.24.0, 7.24.0.
ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to:
* Inject arbitrary HTTP headers
* Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch)
The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters:
// lib/dispatcher/client-h1.js:1121
if (upgrade) {
header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n`
}
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
- CWE
- CWE-93
- Published
- Modified
- Record from
- the NVD, synced
Affected
- nodejs:undici
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-4992-7rv2-5pvq | npm | undici | <6.24.0 | 6.24.0 |
| GHSA-4992-7rv2-5pvq | npm | undici | >=7.0.0 <7.24.0 | 7.24.0 |