Read the docs
TI-2026-01217 Aliases CVE-2026-1527GHSA-4992-7rv2-5pvq

undici is vulnerable to CRLF Injection via upgrade option

Priority LOW 21CWE-93Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 4 fixed, 12 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary HTTP headers * Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch) The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters: // lib/dispatcher/client-h1.js:1121 if (upgrade) { header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n` }

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00315 24th percentileScored 2026-11-07
Fix Partial undici (undici): 6.24.0: 7.24.0undici (npm): 6.24.0, 7.24.0Red Hat: 4 advisoriesRed Hat: 4 fixed, 12 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NodeJSundici< 6.24.0; 7.0.0 < 7.24.06.24.0: 7.24.0Patch availableCNA
—undici (npm)before 6.24.06.24.0Patch availableGHSA-4992-7rv2-5pvq
—undici (npm)7.0.0 to before 7.24.07.24.0Patch availableGHSA-4992-7rv2-5pvq
  • undici VendorNodeJS Affected < 6.24.0; 7.0.0 < 7.24.0 Fixed in 6.24.0: 7.24.0 Patch available CNA
  • undici (npm) Vendor— Affected before 6.24.0 Fixed in 6.24.0 Patch available GHSA-4992-7rv2-5pvq
  • undici (npm) Vendor— Affected 7.0.0 to before 7.24.0 Fixed in 7.24.0 Patch available GHSA-4992-7rv2-5pvq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*before 6.24.0; 7.0.0 to before 7.24.0VulnerableNodeJS
  • cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:* Versions before 6.24.0; 7.0.0 to before 7.24.0 Vulnerable ·NodeJS

Remediation

  • Fix · CNA undici (undici) Fixed in 6.24.0: 7.24.0
  • Fix · GHSA-4992-7rv2-5pvq undici (npm) Fixed in 6.24.0 Advisory →
  • Fix · GHSA-4992-7rv2-5pvq undici (npm) Fixed in 7.24.0 Advisory →

Red Hat 4 advisories

  • RHSA-2026:56431 Released 2026-08-18 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2026:7670 Released 2026-04-13 · Red Hat rating Important
    nodejs:24 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:24.14.1-2.module+el8.10.0+24190+49a46c75.aarch64::nodejs:24, nodejs-1:24.14.1-2.module+el8.10.0+24190+49a46c75.ppc64le::nodejs:24, nodejs-1:24.14.1-2.module+el8.10.0+24190+49a46c75.s390x::nodejs:24 +25
  • RHSA-2026:7675 Released 2026-04-13 · Red Hat rating Important
    nodejs24 security update
    • Red Hat Enterprise Linux AppStream (v. 10) nodejs24-1:24.14.1-2.el10_1, nodejs24-devel-1:24.14.1-2.el10_1, nodejs24-docs-1:24.14.1-2.el10_1 +3
Show 1 more Red Hat advisories
  • RHSA-2026:7350 Released 2026-04-09 · Red Hat rating Important
    nodejs:24 security update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:24.14.1-2.module+el9.7.0+24166+51c9666b.aarch64::nodejs:24, nodejs-1:24.14.1-2.module+el9.7.0+24166+51c9666b.ppc64le::nodejs:24, nodejs-1:24.14.1-2.module+el9.7.0+24166+51c9666b.s390x::nodejs:24 +25

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Cryostat 4AffectedNo fix yet: Fix deferred
OpenShift LightspeedAffectedNo fix yet: Fix deferred
OpenShift PipelinesAffectedNo fix yet: Fix deferred
Red Hat Developer Hub 1AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform 8AffectedNo fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred
Red Hat OpenShift Dev SpacesAffectedNo fix yet: Fix deferred
Self-service automation portal 2AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:7675
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:7670
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:7350
Red Hat Openshift Data Foundation 4.18Fixed RHSA-2026:56431
Not affected: 1 product
  • Red Hat Openshift Data Foundation 4.18

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-1527
  2. 2026-10-03 Alias added: GHSA-4992-7rv2-5pvq
  3. 2026-10-27 Affected versions changed · Red Hat

References

Patch 1

Advisory 2

Other 2

  • TI-2026-01215 undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') CVSS 3.1CRITICAL 9.8
  • TI-2022-16376 `undici.request` vulnerable to SSRF using absolute URL on `pathname` CVSS 3.1CRITICAL 9.8
  • TI-2023-09734 CRLF Injection in Nodejs ‘undici’ via host CVSS 3.1MEDIUM 6.5
  • TI-2022-13193 CRLF injection in request headers CVSS 3.1MEDIUM 6.5
  • TI-2022-16375 CRLF Injection in Nodejs ‘undici’ via Content-Type CVSS 3.1MEDIUM 5.3
  • TI-2022-13194 Uncleared cookies on cross-host/cross-origin redirect in undici CVSS 3.1MEDIUM 6.5
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences