CVE-2022-31150: CRLF injection in request headers
A flaw was found in the undici package. When requesting an input on an unsanitized request path, method, or headers it is possible to inject Carriage Return/Line Feed (CRLF) sequences into these requests.
Other sources
undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate \r\n is a workaround for this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/node-undicito a version that resolves this vulnerability.Fixed in 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4Fixed in 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3Fixed in 7.3.0+dfsg1+~cs24.12.11-1Fixed in 8.12.2+dfsg+~cs3.2.3-2 - Upgrade
Upgrade
debian/node-undicito a version that resolves this vulnerability.Fixed in 5.8.0+dfsg1+~cs18.9.16-1 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 5.8.0 - Compensating control
Sanitize all HTTP headers from untrusted sources to eliminate CRLF sequences (\r\n), including unsanitized request paths, methods, and headers.
Event History
Frequently Asked Questions
What is CVE-2022-31150?
CVE-2022-31150 is a vulnerability in the undici package that allows for the injection of CRLF sequences into request headers in undici versions prior to 5.7.1.
What is the severity of CVE-2022-31150?
CVE-2022-31150 has a severity level of medium, with a CVSS score of 6.5.
How can I fix CVE-2022-31150?
To fix CVE-2022-31150, you should update undici to version 5.8.0 or later.
What is undici?
undici is an HTTP/1.1 client library written from scratch for Node.js.
Is there a workaround for CVE-2022-31150?
Yes, sanitizing all HTTP headers from untrusted sources to eliminate `\r\n` can be used as a workaround for CVE-2022-31150.