{"schema_version":"1.9.0","id":"GHSA-3cvr-822r-rqcc","published":"2022-07-21T20:30:10Z","modified":"2023-11-08T04:09:27.728154Z","aliases":["CVE-2022-31150"],"summary":"undici before v5.8.0 vulnerable to CRLF injection in request headers","details":"### Impact\n\nIt is possible to inject CRLF sequences into request headers in Undici.\n\n```js\nconst undici = require('undici')\n\nconst response = undici.request(\"http://127.0.0.1:1000\", {\n  headers: {'a': \"\\r\\nb\"}\n})\n```\n\nThe same applies to `path` and `method`\n\n### Patches\n\nUpdate to v5.8.0\n\n### Workarounds\n\nSanitize all HTTP headers from untrusted sources to eliminate `\\r\\n`.\n\n### References\n\nhttps://hackerone.com/reports/409943\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12116\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [undici repository](https://github.com/nodejs/undici/issues)\n* To make a report, follow the [SECURITY](https://github.com/nodejs/node/blob/HEAD/SECURITY.md) document\n","affected":[{"package":{"name":"undici","ecosystem":"npm","purl":"pkg:npm/undici"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.8.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-3cvr-822r-rqcc/GHSA-3cvr-822r-rqcc.json"}}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-3cvr-822r-rqcc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31150"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/a29a151d0140d095742d21a004023d024fe93259"},{"type":"WEB","url":"https://hackerone.com/reports/409943"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v5.8.0"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20220915-0002"}],"database_specific":{"cwe_ids":["CWE-93"],"github_reviewed":true,"github_reviewed_at":"2022-07-21T20:30:10Z","nvd_published_at":"2022-07-19T21:15:00Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}