CRLF Injectionundici is an An HTTP/1.1 client, written from scratch for Node.js
Affected versions of this package are vulnerable to CRLF Injection via the writeH1 path in lib/dispatcher/client-h1.js. An attacker can append arbitrary HTTP headers or smuggle a second request by supplying a duck-typed blob-like body whose .type contains \r\n when an application sends it through request(), stream(), pipeline(), or dispatch() without an explicit content-type header. The vulnerable code copies body.type directly into the outgoing content-type header, so the injected newline sequence is written on the wire and processed by the upstream HTTP/1.1 server. This can corrupt request handling and expose or alter requests sent by the user.
How to fix CRLF Injection? Upgrade undici to version 6.28.0, 7.29.0, 8.9.0 or higher.
| <6.28.0>=7.0.0 <7.29.0>=8.0.0 <8.9.0 |
HTTP Request Smugglingundici is an An HTTP/1.1 client, written from scratch for Node.js
Affected versions of this package are vulnerable to HTTP Request Smuggling due to the interceptors.retry() flow in lib/handler/retry-handler.js. An attacker can cause a proxy or gateway that forwards Undici responses to emit a body whose length does not match the Content-Length header by sending a partial 206 response with mismatched framing and closing the connection to trigger a retry or resume. This can corrupt downstream HTTP framing, causing client or intermediary hangs and response parsing errors, and can expose users of the forwarding service to broken responses or connection desynchronization.
How to fix HTTP Request Smuggling? Upgrade undici to version 6.28.0, 7.29.0, 8.9.0 or higher.
| <6.28.0>=7.0.0 <7.29.0>=8.0.0 <8.9.0 |
Improper Neutralizationundici is an An HTTP/1.1 client, written from scratch for Node.js
Affected versions of this package are vulnerable to Improper Neutralization via unsanitized domain handling and unparsed attribute serialization in lib/web/cookies/util.js. An attacker can inject or override cookie attributes by supplying a crafted domain such as example.com; SameSite=None or an unparsed entry such as X-Custom=val; HttpOnly to setCookie. When applications pass user-controlled tenant or routing data into these fields, the serialized Set-Cookie header can carry attacker-chosen flags like SameSite, Secure, or HttpOnly. This can weaken CSRF protections, alter cookie visibility to scripts, or change how the browser sends the cookie.
How to fix Improper Neutralization? Upgrade undici to version 6.28.0, 7.29.0, 8.9.0 or higher.
| <6.28.0>=7.0.0 <7.29.0>=8.0.0 <8.9.0 |
