CVE-2026-1527

ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (rn) to:

• Inject arbitrary HTTP headers
• Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch) The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters:

// lib/dispatcher/client-h1.js:1121 if (upgrade) { header += connection: upgradernupgrade: ${upgrade}rn }

Weakness

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Affected Software

Potential Mitigations

Related Attack Patterns

• https://cwe.mitre.org/data/definitions/15.html
• https://cwe.mitre.org/data/definitions/81.html

References

• https://cna.openjsf.org/security-advisories.html
• https://github.com/nodejs/undici/security/advisories/GHSA-4992-7rv2-5pvq
• https://hackerone.com/reports/3487198