MediumGHSA-3cvr-822r-rqccCVE-2022-31150

undici before v5.8.0 vulnerable to CRLF injection in request headers

Published 21 Jul 2022 · Updated 8 Nov 2023

Affected package

undicinpm

Affected: <5.8.0
Fixed in: 5.8.0

Update to the fixed version for your release line, for example:npm install undici@5.8.0

Details

Impact

It is possible to inject CRLF sequences into request headers in Undici.

const undici = require('undici')

const response = undici.request("http://127.0.0.1:1000", {
  headers: {'a': "\r\nb"}
})

The same applies to path and method

Patches

Update to v5.8.0

Workarounds

Sanitize all HTTP headers from untrusted sources to eliminate \r\n.

References

https://hackerone.com/reports/409943 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12116

For more information

If you have any questions or comments about this advisory:

Open an issue in undici repository
To make a report, follow the SECURITY document

Is GHSA-3cvr-822r-rqcc in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected undici, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.