CVE-2026-1527 in undici
Summary
by MITRE • 03/12/2026
ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to:
* Inject arbitrary HTTP headers * Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch) The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters:
// lib/dispatcher/client-h1.js:1121 if (upgrade) {
header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n`
}
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/12/2026
The vulnerability identified as CVE-2026-1527 represents a critical HTTP request smuggling flaw in the undici HTTP client library that enables attackers to manipulate HTTP headers through improper input validation. This vulnerability specifically manifests when applications pass user-controlled data to the upgrade option of the client.request() method, creating a pathway for malicious actors to inject carriage return line feed sequences that disrupt normal HTTP request processing. The flaw stems from the library's direct writing of upgrade values to network sockets without proper validation of header characters, which violates fundamental security principles of input sanitization and header validation.
The technical exploitation of this vulnerability allows attackers to inject arbitrary HTTP headers by leveraging the CRLF injection capability within the upgrade parameter handling. When the upgrade value contains maliciously crafted sequences, the undici library processes these directly without sanitization, enabling header injection attacks that can manipulate the HTTP request flow. The vulnerability particularly impacts the connection and upgrade header fields where the library constructs the header string using string interpolation without character validation. This creates a scenario where attackers can terminate the HTTP request prematurely and subsequently smuggle raw data to non-HTTP services such as Redis, Memcached, and Elasticsearch, effectively bypassing normal HTTP protocol boundaries.
The operational impact of this vulnerability extends beyond simple header manipulation to enable sophisticated attack vectors including service smuggling and potential data exfiltration. Attackers can exploit this flaw to inject headers that cause the HTTP client to connect to backend services that are typically not directly accessible through HTTP protocols, effectively creating a tunneling mechanism for data access. The vulnerability affects any application using the undici library with user-controlled upgrade parameters, making it particularly dangerous in web applications, API gateways, and microservices architectures where such inputs are common. This vulnerability directly maps to CWE-113 (Improper Neutralization of CRLF Sequences in HTTP Headers) and aligns with ATT&CK technique T1071.004 (Application Layer Protocol: DNS) in its ability to manipulate protocol boundaries for unauthorized access.
Mitigation strategies for CVE-2026-1527 require immediate implementation of input validation and sanitization measures within applications using the affected undici library. Organizations should implement strict validation of all upgrade parameter values, rejecting any input containing CRLF sequences or other potentially malicious header characters. The recommended approach includes sanitizing user input before passing it to client.request() methods, implementing proper header validation routines, and upgrading to patched versions of the undici library where available. Security teams should also consider implementing network segmentation and monitoring for unusual header patterns that might indicate exploitation attempts. Additionally, applications should employ proper input validation frameworks that can detect and block malicious header injection attempts, and regular security assessments should be conducted to identify similar vulnerabilities in other HTTP client implementations that might present similar attack surfaces.