CRLF injection in undici - CVE-2026-1527

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU127577

CRLF injection in undici - CVE-2026-1527

Published: April 24, 2026


Vulnerability identifier: #VU127577
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-1527
CWE-ID: CWE-93
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to inject arbitrary HTTP headers and smuggle raw data to non-HTTP services.

The vulnerability exists due to improper neutralization of CRLF sequences in the upgrade option of client.request() when processing user-controlled input. A remote attacker can supply a specially crafted upgrade value to inject arbitrary HTTP headers and smuggle raw data to non-HTTP services.

User interaction is required because an application must pass user-controlled input to the upgrade option.


Affected software

undici
IBM Cloud Pak System
DataStage on Cloud Pak for Data
Platform Navigator in IBM Cloud Pak for Integration (CP4I)
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Fedora
nodejs20
nodejs22
nodejs24 (Red Hat package)

How to mitigate CVE-2026-1527

Install security update from vendor's website.

undici - addressed in versions 6.24.0, 7.24.0
IBM Cloud Pak System - update to 2.3.5.1
DataStage on Cloud Pak for Data - update to 5.4
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - addressed in versions 16.1.0.23, 16.1.3.6
nodejs20 - update to 20.20.2-3.fc43
nodejs22 - addressed in versions 22.22.2-2.fc43, 22.22.2-3.fc42, 22.22.2-3.fc44
nodejs24 (Red Hat package) - update to 24.14.1-2.el10_1

External References

Related Security Bulletins