ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to:
* Inject arbitrary HTTP headers * Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch) The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters:
// lib/dispatcher/client-h1.js:1121 if (upgrade) { header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n` }
CVSS Details
- CVSS 3.1 Base Score: 4.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-develUpgrade nodejs-libsUpgrade npmUpgrade v8-13.6-develUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-nodemonUpgrade nodejs-docs | Apr 16, 2026 | Apr 9, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs20-debuginfoUpgrade nodejs20-libs-debuginfoUpgrade nodejs22-npmUpgrade nodejs22-debugsourceUpgrade nodejs24-debuginfoUpgrade nodejs24-full-i18nUpgrade nodejs20Upgrade nodejs24Upgrade nodejs24-libs-debuginfoUpgrade nodejs22-develUpgrade nodejs20-develUpgrade nodejs22-docsUpgrade nodejs20-libsUpgrade nodejs22-libsUpgrade nodejs20-full-i18nUpgrade nodejs24-libsUpgrade nodejs24-debugsourceUpgrade nodejs20-debugsourceUpgrade v8-12.4-develUpgrade nodejs22Upgrade nodejs22-debuginfoUpgrade v8-13.6-develUpgrade nodejs24-docsUpgrade nodejs24-develUpgrade nodejs22-full-i18nUpgrade nodejs22-libs-debuginfoUpgrade nodejs20-npmUpgrade v8-11.3-develUpgrade nodejs20-docsUpgrade nodejs24-npm | Apr 7, 2026 | Mar 12, 2026 |
| Oracle_linux | — | Upgrade nodejs24Upgrade nodejsUpgrade nodejs24-full-i18nUpgrade nodejs-packaging-bundlerUpgrade v8-13.6-develUpgrade nodejs24-libsUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs24-npmUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs24-develUpgrade nodejs-nodemonUpgrade nodejs24-docsUpgrade nodejs-libs | Apr 22, 2026 | Mar 12, 2026 |
| Redhat_linux | — | Upgrade nodejs24-debugsourceUpgrade nodejs24Upgrade nodejs-packaging-bundlerUpgrade nodejs-libs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs24-full-i18nUpgrade nodejs24-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-develUpgrade npmUpgrade nodejs-libsUpgrade nodejs24-libsUpgrade nodejs-full-i18nNo solution existsUpgrade nodejs24-npmUpgrade v8-13.6-develUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-develUpgrade nodejs24-docs | Apr 13, 2026 | Mar 12, 2026 |
| Rocky_linux | — | Upgrade nodejs24Upgrade nodejs-libsUpgrade nodejs24-develUpgrade nodejs24-libsUpgrade v8-13.6-develUpgrade nodejs24-libs-debuginfoUpgrade nodejs-develUpgrade nodejsUpgrade nodejs24-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-libs-debuginfoUpgrade nodejs24-debugsourceUpgrade nodejs-debugsourceUpgrade nodejs24-full-i18nUpgrade nodejs-debuginfo | Apr 13, 2026 | Apr 10, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub