CVE-2026-1527: undici is vulnerable to CRLF Injection via upgrade option

Severity: medium (CVSS 4.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-12 · updated 2026-06-17
Weakness: CWE-93

Description

ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary HTTP headers * Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch) The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters: // lib/dispatcher/client-h1.js:1121 if (upgrade) { header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n` }

Affected products

undici: before 6.24.0; from 7.0.0 before 7.24.0 — fixed in 6.24.0, 7.24.0
Npm Undici: before 6.24.0; from 7.0.0 before 7.24.0 — fixed in 6.24.0, 7.24.0

How to fix

Upgrade to a fixed version: undici 6.24.0, 7.24.0; Npm Undici 6.24.0, 7.24.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-1527 or the next vulnerability affects your stack