CVE-2026-1527: undici is vulnerable to CRLF Injection via upgrade option
### Impact When an application passes user-controlled input to the `upgrade` option of `client.request()`, an attacker can inject CRLF sequences (`\r\n`) to: 1. Inject arbitrary HTTP headers 2. Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch) The vulnerability exists because undici writes the `upgrade` value directly to the socket without validating for invalid header characters: ```javascript // lib/dispatcher/client-h1.js:1121 if (upgrade) { header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n` } ``` ### Patches Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later. ### Workarounds Sanitize the `upgrade` option string before passing to undici: ```javascript function sanitizeUpgrade(value) { if (/[\r\n]/.test(value)) { throw new Error('Invalid upgrade value') } return value } client.request({ upgrade: sanitizeUpgrade(userInput) }) ```
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1527?
CVE-2026-1527 has a high severity rating due to its potential to allow attackers to inject arbitrary HTTP headers and manipulate HTTP requests.
How do I fix CVE-2026-1527?
To fix CVE-2026-1527, ensure that user-controlled input to the upgrade option of client.request() is properly validated and sanitized.
What software is affected by CVE-2026-1527?
CVE-2026-1527 affects the npm package 'undici', specifically versions that allow untrusted user input in the upgrade option.
What type of attack can be performed using CVE-2026-1527?
CVE-2026-1527 enables CRLF injection attacks, which can lead to arbitrary HTTP header injection or HTTP request smuggling.
Is CVE-2026-1527 being actively exploited?
While there are no specific reports of active exploitation for CVE-2026-1527, the nature of the vulnerability poses a significant risk if left unaddressed.