Vulnerability in Undici Client Request Allowing HTTP Header Injection
CVE-2026-1527

4.6MEDIUM

Key Information:

Vendor

Undici

Status
Undici
Vendor
CVE Published:
12 March 2026

What is CVE-2026-1527?

A vulnerability in the Undici HTTP client allows for user-controlled input to lead to HTTP header injection and request smuggling. By passing invalid characters through the upgrade option of client.request(), attackers can manipulate HTTP headers, potentially injecting arbitrary headers into requests. This opens pathways for terminating HTTP requests prematurely, allowing raw data to be sent to non-HTTP services such as Redis, Memcached, and Elasticsearch. The issue is tied to the lack of validation when writing the upgrade value directly to the socket, making it a significant concern for users of the Undici library.

Affected Version(s)

undici < 6.24.0; 7.0.0 < 7.24.0 < 6.24.0; 7.0.0 < 7.24.0

undici 6.24.0: 7.24.0

References

https://github.com/nodejs/undici/security/advisories/GHSA...
https://hackerone.com/reports/3487198
https://cna.openjsf.org/security-advisories.html

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Matteo Collina
Ulises GascĂłn
Raul Vega del Valle
.