Skip to content
Fencer Vulns
medium 4.6

CVE-2026-1527 json

undici is vulnerable to CRLF Injection via upgrade option

published 2026-03-12 7 mo ago modified 2026-09-10 1 mo ago also GHSA-4992-7rv2-5pvq , EUVD-2026-11701

cvss
4.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 24%
public exploits
0
none known

Summary

ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to:

* Inject arbitrary HTTP headers * Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch) The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters:

// lib/dispatcher/client-h1.js:1121 if (upgrade) { header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n` }

Patch / fix

  • npm undici 6.24.0, 7.24.0
  • undici undici 6.24.0: 7.24.0
  • node-undici Debian 14 7.24.5+dfsg+~cs3.2.0-1

debian advisories DEBIAN-CVE-2026-1527

  • nodejs24 RHEL 10.1 1:24.14.1-2.el10_1
  • nodejs24-npm RHEL 10.1 1:11.11.0-1.24.14.1.2.el10_1
  • nodejs24-libs RHEL 10.1 1:24.14.1-2.el10_1
  • nodejs24-full-i18n RHEL 10.1 1:24.14.1-2.el10_1
  • npm RHEL 8 1:11.11.0-1.24.14.1.2.module+el8.10.0+24190+49a46c75
  • nodejs RHEL 8 1:24.14.1-2.module+el8.10.0+24190+49a46c75
  • nodejs-libs RHEL 8 1:24.14.1-2.module+el8.10.0+24190+49a46c75
  • nodejs-nodemon RHEL 8 3.0.3-1.module+el8.10.0+24190+49a46c75

red hat advisories RHSA-2026:7675RHSA-2026:7670RHSA-2026:7350

  • npm AlmaLinux 8 1:11.11.0-1.24.14.1.2.module_el8.10.0+4160+4819ac42
  • nodejs AlmaLinux 8 1:24.14.1-2.module_el8.10.0+4160+4819ac42
  • nodejs-libs AlmaLinux 8 1:24.14.1-2.module_el8.10.0+4160+4819ac42
  • nodejs-nodemon AlmaLinux 8 3.0.3-1.module_el8.10.0+4061+f8ceeab9
  • nodejs-full-i18n AlmaLinux 8 1:24.14.1-2.module_el8.10.0+4160+4819ac42
  • nodejs-packaging AlmaLinux 8 2021.06-6.module_el8.10.0+4086+70facd4a
  • nodejs-packaging-bundler AlmaLinux 8 2021.06-6.module_el8.10.0+4086+70facd4a
  • nodejs24-npm AlmaLinux 10 1:11.11.0-1.24.14.1.2.el10_1

almalinux advisories ALSA-2026:7670ALSA-2026:7675ALSA-2026:7350

  • nodejs24 Rocky Linux 10 1:24.14.1-2.el10_1
  • nodejs-nodemon Rocky Linux 8 3.0.3-1.module+el8.10.0+2084+ab509703
  • nodejs-packaging Rocky Linux 8 2021.06-6.module+el8.10.0+40048+6d99f608
  • nodejs-nodemon Rocky Linux 9 3.0.3-3.module+el9.7.0+40025+0e0cf6b2
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.7.0+40052+e32ea525

rocky linux advisories RLSA-2026:7675RLSA-2026:7670RLSA-2026:7350

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-1527 updated cvss 6.5

undici: Undici: HTTP header injection and request smuggling vulnerability

  • Red Hat Cryostat 4 io.cryostat-cryostat Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9, openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-console-plugin-rhel9 Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9, rhdh/backstage-community-plugin-catalog-backend-module-scaffolder-relation-processor Red Hat Enterprise Linux 8 npm, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, nodejs-packaging, +1 more Red Hat Enterprise Linux 9 npm, nodejs, nodejs-libs, nodejs-full-i18n
    +6 more products
    Red Hat Enterprise Linux 10 nodejs22 Red Hat JBoss Enterprise Application Platform 8 org.keycloak-keycloak-parent Red Hat JBoss Enterprise Application Platform Expansion Pack org.keycloak-keycloak-parent Red Hat OpenShift AI (RHOAI) rhoai/odh-dashboard-rhel8, rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9, rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9, rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9, rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9, rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9, +13 more Red Hat OpenShift Dev Spaces devspaces/code-rhel9, devspaces/openvsx-rhel9, devspaces/code-sshd-rhel9 Red Hat Self-service automation portal 2 ansible-automation-platform/automation-portal
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 24.14.1-2.module+el8.10.0+24190+49a46c75, nodejs-libs 24.14.1-2.module+el8.10.0+24190+49a46c75, nodejs-nodemon 3.0.3-1.module+el8.10.0+24190+49a46c75, npm 11.11.0-1.24.14.1.2.module+el8.10.0+24190+49a46c75, nodejs-full-i18n 24.14.1-2.module+el8.10.0+24190+49a46c75, nodejs-packaging 2021.06-6.module+el8.10.0+24190+49a46c75, +1 more
    fixed: vendor fix RHSA-2026:7670
  • Red Hat Enterprise Linux AppStream (v. 9) nodejs 24.14.1-2.module+el9.7.0+24166+51c9666b, nodejs-libs 24.14.1-2.module+el9.7.0+24166+51c9666b, nodejs-nodemon 3.0.3-3.module+el9.7.0+24166+51c9666b, npm 11.11.0-1.24.14.1.2.module+el9.7.0+24166+51c9666b, nodejs-full-i18n 24.14.1-2.module+el9.7.0+24166+51c9666b, nodejs-packaging 2021.06-6.module+el9.7.0+24166+51c9666b, +1 more
    fixed: vendor fix RHSA-2026:7350
  • Red Hat Enterprise Linux AppStream (v. 10) nodejs24 24.14.1-2.el10_1, nodejs24-libs 24.14.1-2.el10_1, nodejs24-full-i18n 24.14.1-2.el10_1, nodejs24-npm 11.11.0-1.24.14.1.2.el10_1
    fixed: vendor fix RHSA-2026:7675
  • Red Hat Openshift Data Foundation 4.18 odf4/cephcsi-rhel9 1786705347, odf4/odf-cli-rhel9 1786705938, odf4/mcg-core-rhel9 1786705558, odf4/odf-console-rhel9 1786706577, odf4/mcg-rhel9-operator 1786705646, odf4/ocs-rhel9-operator 1786705802, +13 more
    fixed: vendor fix RHSA-2026:56431
  • Red Hat Openshift Data Foundation 4.18 odf4/mcg-operator-bundle 1786708633, odf4/ocs-operator-bundle 1786708778, odf4/odf-operator-bundle 1786709119, odf4/cephcsi-operator-bundle 1786708508, odf4/odr-hub-operator-bundle 1786709184, odf4/rook-ceph-operator-bundle 1786709254, +7 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
7 mo ago

Exploit prediction

0.32% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
GitHub 3.1 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
npm undici
<6.24.0
>=7.0.0, <7.24.0
6.24.0
7.24.0

Affected products

  • undici undici

Classification

Weakness
  • CWE-93 Improper Neutralization of CRLF Sequences

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.