CVE-2026-1527: HTTP Header Injection Vulnerability

CVE-2026-1527 Overview

CVE-2026-1527 is a CRLF Injection vulnerability affecting the Undici HTTP client library for Node.js. When an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to manipulate HTTP headers and potentially smuggle raw data to non-HTTP services such as Redis, Memcached, and Elasticsearch.

The vulnerability exists because Undici writes the upgrade value directly to the socket without validating for invalid header characters. This allows attackers to terminate HTTP requests prematurely and inject arbitrary content into the data stream.

Critical Impact

Attackers can inject arbitrary HTTP headers and smuggle raw data to backend services, potentially leading to cache poisoning, session hijacking, or unauthorized command execution on non-HTTP services.

Affected Products

• Undici HTTP client for Node.js (vulnerable versions)
• Node.js applications using client.request() with user-controlled upgrade options

Discovery Timeline

• 2026-03-12 - CVE CVE-2026-1527 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-1527

Vulnerability Analysis

This CRLF Injection vulnerability (CWE-93) resides in the Undici HTTP client's handling of the upgrade option within client.request(). The flaw occurs in lib/dispatcher/client-h1.js at line 1121, where the library constructs HTTP upgrade headers without sanitizing user-supplied input.

When processing an upgrade request, the vulnerable code directly interpolates user input into the HTTP header string without validating or escaping CRLF characters. This allows an attacker to break out of the intended header context and inject additional headers or terminate the HTTP request entirely.

The network-accessible nature of this vulnerability means attackers can exploit it remotely, though exploitation requires user interaction and low-level privileges. The attack can compromise both confidentiality and integrity of data, though availability is not directly impacted.

Root Cause

The root cause is improper input validation in the Undici HTTP client. Specifically, the upgrade option value is concatenated directly into the HTTP header string without any sanitization for CRLF sequences or other invalid header characters. The vulnerable code pattern is:

// lib/dispatcher/client-h1.js:1121
if (upgrade) {
  header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n`
}

This allows an attacker-controlled upgrade value containing \r\n to inject additional headers or terminate the HTTP portion of the request.

Attack Vector

This is a network-based attack vector requiring low privileges and user interaction. An attacker can exploit this vulnerability by supplying a malicious upgrade option value containing CRLF sequences. The attack flow involves:

1. Injecting CRLF sequences (\r\n) into the upgrade parameter
2. Breaking out of the HTTP header context to inject arbitrary headers
3. Terminating the HTTP request prematurely with double CRLF (\r\n\r\n)
4. Smuggling raw data payloads to backend non-HTTP services

This enables HTTP Request Smuggling attacks against backend services like Redis, Memcached, or Elasticsearch that may be accessible through the same connection pathway.

Detection Methods for CVE-2026-1527

Indicators of Compromise

• Unusual HTTP upgrade requests containing encoded or raw CRLF sequences (%0d%0a or \r\n)
• Unexpected commands or data appearing in logs from backend services like Redis or Memcached
• HTTP requests with malformed or duplicate headers indicating injection attempts

Detection Strategies

• Deploy web application firewalls (WAF) with rules to detect CRLF injection patterns in HTTP headers
• Implement input validation logging to identify requests containing \r\n, %0d%0a, or similar encoded sequences
• Monitor application logs for unusual upgrade header values or malformed HTTP requests
• Use SentinelOne Singularity to detect anomalous network traffic patterns indicative of HTTP smuggling attempts

Monitoring Recommendations

• Enable detailed HTTP request logging on applications using Undici to capture upgrade header values
• Set up alerts for connections to backend services (Redis, Memcached, Elasticsearch) that follow unusual HTTP patterns
• Monitor for application crashes or unexpected behavior that could indicate exploitation attempts

How to Mitigate CVE-2026-1527

Immediate Actions Required

• Review all code paths where user input is passed to client.request() upgrade options
• Implement strict input validation to reject any upgrade values containing CRLF characters
• Apply the vendor security patch as soon as it becomes available
• Consider restricting access to backend services to limit the impact of potential HTTP smuggling

Patch Information

Security patches and detailed remediation guidance are available through the official security advisories:

• GitHub Security Advisory GHSA-4992 - Official Undici security advisory with patch information
• OpenJSF Security Advisories - OpenJS Foundation security advisory listing
• HackerOne Report #3487198 - Original vulnerability report

Update Undici to the latest patched version as specified in the security advisories.

Workarounds

• Sanitize all user input before passing it to client.request() upgrade options by stripping or rejecting CRLF characters
• Implement application-level input validation that explicitly blocks \r, \n, %0d, and %0a sequences
• Use a reverse proxy or WAF to filter malicious upgrade headers before they reach the application
• Isolate backend non-HTTP services from the network path accessible by the HTTP client

# Example input validation for Node.js applications
# Add to request handling code before calling client.request()
# Reject any upgrade value containing CRLF characters
if (userInput.match(/[\r\n]/)) {
  throw new Error('Invalid characters in upgrade option');
}