Executive brief
Node.js undici is an HTTP client library used by many Node.js applications to make web requests. A vulnerability in how it processes the Content-Type header allows attackers to inject carriage return and line feed characters, enabling them to craft malicious HTTP headers that cause a single request to be split into multiple requests. This could allow an attacker to bypass security controls or perform unauthorized actions if the application uses unsanitized user input in Content-Type headers.
Technical details
This vulnerability is a CRLF injection flaw in the undici HTTP client library affecting versions up to 5.8.1. The root cause is insufficient sanitization of the Content-Type header value; when an attacker injects CRLF sequences (\r\n) into the header, the HTTP parser interprets them as header delimiters, allowing injection of additional HTTP headers or even separate HTTP requests. The attack vector is network-based and requires no authentication or user interaction, but does require that the application passes unsanitized input directly to the Content-Type header parameter. An attacker can manipulate request routing, inject headers, or trigger unintended requests to different endpoints. The vulnerability was patched in version 5.8.2.
Affected products
- Node.js undici <=5.8.1
Timeline
- 2022-08-09: disclosed: Advisory published by Node.js undici maintainers
- 2022-08-15: patched: Patched in version 5.8.2