Executive brief
Undici is an HTTP/1.1 client library for Node.js. When an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject carriage return and line feed characters to inject arbitrary HTTP headers or smuggle raw data to non-HTTP services like Redis or Memcached. This could lead to header spoofing, request manipulation, and protocol confusion attacks.
Technical details
The vulnerability is a CRLF (Carriage Return Line Feed) injection flaw in undici's HTTP/1.1 client implementation, specifically in the handling of the upgrade option passed to client.request(). The root cause is that undici writes the upgrade value directly to the socket without validating for invalid header characters in lib/dispatcher/client-h1.js. An attacker who can control the upgrade parameter can inject \r\n sequences to inject arbitrary HTTP headers, terminate HTTP requests prematurely, or perform HTTP request smuggling to non-HTTP services. The attack requires network access and the application must pass user input directly to the upgrade option. Patches are available in undici v6.24.0 and v7.24.0. As a workaround, applications should validate and sanitize the upgrade option to reject strings containing \r or \n characters.
Affected products
- nodejs undici < 6.24.0; >= 7.0.0 and < 7.24.0
Timeline
- 2026-03-13: disclosed
- 2026-03-13: patched: Fixed in undici v6.24.0 and v7.24.0