Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary HTTP headers * Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch) The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters: // lib/dispatcher/client-h1.js:1121 if (upgrade) { header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n` }
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-1527 ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrar… https://www.cve.org/CVERecord?id=CVE-2026-1527
Post summary
The excerpt outlines a CRLF injection flaw in client.request()'s upgrade option, providing minimal technical details without indicating a PoC, exploit code, patch, or active exploitation.
🚨 Medium-severity security fix in undici@7.24.0 just released! Patches CVE-2026-1527 — vulnerable to CRLF injection via the upgrade option. https://github.com/nodejs/undici/security/advisories/GHSA-4992-7rv2-5pvq
Post summary
A medium‑severity patch for undici 7.24.0 addresses CVE‑2026‑1527, a CRLF injection flaw in the upgrade option; the advisory confirms the fix but no exploits or real‑world attacks are reported.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | nodejs | undici | - | node.js | - |