GHSA-f772-66g8-q5h3 CVE-2022-35948

Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type

Medium npm

Severity: 5.3 / 10; Medium · CVSS 3.1
Exploit chance (EPSS): 1.39%; Chance of exploitation in the next 30 days. Higher than 72.34% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')
Fix: 5.8.2; Upgrade undici to this version or later

Description

Impact

=< undici@5.8.0 users are vulnerable to CRLF Injection on headers when using unsanitized input as request headers, more specifically, inside the content-type header.

Example:

import { request } from 'undici'

const unsanitizedContentTypeInput =  'application/json\r\n\r\nGET /foo2 HTTP/1.1'

await request('http://localhost:3000, {
    method: 'GET',
    headers: {
      'content-type': unsanitizedContentTypeInput
    },
})

The above snippet will perform two requests in a single request API call:

http://localhost:3000/
http://localhost:3000/foo2

Patches

This issue was patched in Undici v5.8.1

Workarounds

Sanitize input when sending content-type headers using user input.

For more information

If you have any questions or comments about this advisory:

Open an issue in undici repository
To make a report, follow the SECURITY document

Affected versions

npm

Package	Vulnerable	Fixed in
undici	`< 5.8.2`	`5.8.2`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

undici npm → `5.8.2`

npm

npm install undici@5.8.2

yarn

yarn add undici@5.8.2

pnpm

pnpm add undici@5.8.2

Severity breakdown

CVSS 3.1 5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: Low
Availability: None

Weakness

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

How to prevent it

Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.

CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

How to prevent it

Implementation: Avoid using CRLF as a special sequence.
Implementation: Appropriately filter or quote CRLF sequences in user-controlled input.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2022-35948

Packages

github.com/nodejs/undici

Timeline

Aug 15, 2022 Published
Jun 17, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-55wc-3pg8-jfw6 undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor	High	Also affects undici
GHSA-qrxm-fqhp-jwvm undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation	High	Also affects undici
GHSA-9fm3-97px-rjf6 undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering	High	Also affects undici
GHSA-4qv8-2p9j-2685 undici vulnerable to Denial of Service via unbounded memory in the EventSource parser	High	Also affects undici
GHSA-xjj6-f33q-929c undici vulnerable to Denial of Service via unhandled error on excessive content-encodings	High	Also affects undici
GHSA-f72v-6w45-q472 undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens	High	Also affects undici
GHSA-4w7w-5xrc-9h26 undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects	Critical	Also affects undici
GHSA-2m5v-pch6-74hx undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent	Critical	Also affects undici

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor