Every CVE Search/ Get API key

CVE-2022-31150

CRLF injection in request headers

5.3 MediumFix available

undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate \r\n is a workaround for this issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

1.52%Up 0.6 points since Jul 20, 2022
90%50%10%1%

What each source reports

CVE List Score used 5.3

CRLF injection in request headers

undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate \r\n is a workaround for this issue.

Record
CVE-2022-31150
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-93
Updated
2026-11-02
EUVDEUVD-2022-6216 5.3

undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate \r\n is a workaround for this issue.

Record
EUVD-2022-6216
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-3cvr-822r-rqcc 5.3

undici before v5.8.0 vulnerable to CRLF injection in request headers

Impact

It is possible to inject CRLF sequences into request headers in Undici.

const undici = require('undici')

const response = undici.request("http://127.0.0.1:1000", {
  headers: {'a': "\r\nb"}
})

The same applies to path and method

Patches

Update to v5.8.0

Workarounds

Sanitize all HTTP headers from untrusted sources to eliminate \r\n.

References

https://hackerone.com/reports/409943 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12116

For more information

If you have any questions or comments about this advisory:

Record
GHSA-3cvr-822r-rqcc
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-93
Updated
2026-11-02
NVD 5.3

undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate \r\n is a workaround for this issue.

Record
CVE-2022-31150
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-93
Updated
2026-11-02
OSV 5.3

CRLF injection in request headers

undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate \r\n is a workaround for this issue.

Record
CVE-2022-31150
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-93
Updated
2026-11-02
OSVDEBIAN-CVE-2022-31150 6.5

undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate \r\n is a workaround for this issue.

Record
DEBIAN-CVE-2022-31150
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-03
Show 7 moreShow less
OSVGHSA-3cvr-822r-rqcc 5.3

undici before v5.8.0 vulnerable to CRLF injection in request headers

Impact

It is possible to inject CRLF sequences into request headers in Undici.

const undici = require('undici')

const response = undici.request("http://127.0.0.1:1000", {
  headers: {'a': "\r\nb"}
})

The same applies to path and method

Patches

Update to v5.8.0

Workarounds

Sanitize all HTTP headers from untrusted sources to eliminate \r\n.

References

https://hackerone.com/reports/409943 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12116

For more information

If you have any questions or comments about this advisory:

Record
GHSA-3cvr-822r-rqcc
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-93
Updated
2026-11-02
OSVUBUNTU-CVE-2022-31150 5.3

undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate \r\n is a workaround for this issue.

Record
UBUNTU-CVE-2022-31150
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVCLSA-2026-1788560495 No score

TuxCare security update for undici (14 CVEs)

TuxCare rebuilt undici to address 14 CVEs. Fixed in 5.5.1-tuxcare.1.

Record
CLSA-2026-1788560495
Updated
2026-11-02
OSVopenSUSE-SU-2024:12285-1 No score

corepack16-16.17.0-2.1 on GA media

These are all security issues fixed in the corepack16-16.17.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12285-1
Updated
2026-11-02
OSVSUSE-SU-2022:3196-1 No score

Security update for nodejs16

This update for nodejs16 fixes the following issues:

  • CVE-2022-35949: Fixed SSRF when an application takes in user input into the path/pathname option of undici.request (bsc#1202382).
  • CVE-2022-35948: Fixed CRLF injection via Content-Type (bsc#1202383).
  • CVE-2022-29244: Fixed npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (bsc#1200517).
  • CVE-2022-31150: Fixed CRLF injection in node-undici (bsc#1201710).

Bugfixes:

  • Enable crypto-policies for SLE15 SP4+ and TW (bsc#1200303)
Record
SUSE-SU-2022:3196-1
Updated
2026-11-02
OSVSUSE-SU-2022:3250-1 No score

Security update for nodejs16

This update for nodejs16 fixes the following issues:

  • CVE-2022-35949: Fixed SSRF when an application takes in user input into the path/pathname option of undici.request (bsc#1202382).
  • CVE-2022-35948: Fixed CRLF injection via Content-Type (bsc#1202383).
  • CVE-2022-29244: Fixed npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (bsc#1200517).
  • CVE-2022-31150: Fixed CRLF injection in node-undici (bsc#1201710).

Bugfixes:

  • Enable crypto-policies for SLE15 SP4+ and TW (bsc#1200303)
Record
SUSE-SU-2022:3250-1
Updated
2026-11-02
OSVSUSE-SU-2022:3251-1 No score

Security update for nodejs16

This update for nodejs16 fixes the following issues:

  • CVE-2022-35949: Fixed SSRF when an application takes in user input into the path/pathname option of undici.request (bsc#1202382).
  • CVE-2022-35948: Fixed CRLF injection via Content-Type (bsc#1202383).
  • CVE-2022-29244: Fixed npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (bsc#1200517).
  • CVE-2022-31150: Fixed CRLF injection in node-undici (bsc#1201710).

Bugfixes:

  • Enable crypto-policies for SLE15 SP4+ and TW (bsc#1200303)
Record
SUSE-SU-2022:3251-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
undici
npm
 before 5.8.0
5.8.0
undici
TuxCare:npm
From an advisory covering 14 CVEs
 5.5.1-tuxcare.0 up to 5.5.1-tuxcare.1, plus listed versions
5.5.1
5.5.1-tuxcare.1
node-undici
Debian:12
 before 5.8.0+dfsg1+~cs18.9.16-1
5.8.0+dfsg1+~cs18.9.16-1
node-undici
Debian:13
 before 5.8.0+dfsg1+~cs18.9.16-1
5.8.0+dfsg1+~cs18.9.16-1
node-undici
Debian:14
 before 5.8.0+dfsg1+~cs18.9.16-1
5.8.0+dfsg1+~cs18.9.16-1
nodejs16
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 4 CVEs
 before 16.17.0-8.9.1
16.17.0-8.9.1
nodejs16
SUSE:Linux Enterprise Module for Web and Scripting 15 SP4
From an advisory covering 4 CVEs
 before 16.17.0-150400.3.6.1
16.17.0-150400.3.6.1
nodejs16
openSUSE:Leap 15.4
From an advisory covering 4 CVEs
 before 16.17.0-150400.3.6.1
16.17.0-150400.3.6.1
nodejs16
SUSE:Linux Enterprise Module for Web and Scripting 15 SP3
From an advisory covering 4 CVEs
 before 16.17.0-150300.7.9.1
16.17.0-150300.7.9.1
nodejs16
openSUSE:Leap 15.3
From an advisory covering 4 CVEs
 before 16.17.0-150300.7.9.1
16.17.0-150300.7.9.1
Show 5 moreShow less
Affected packages
PackageAffectedFixed
node-undici
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.22.1+dfsg1+~cs20.10.10.2-1ubuntu15.26.3+dfsg1+~cs23.10.12-2
 None known
node-undici
Ubuntu:25.10
 All versions, plus listed versions
7.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-2
 None known
node-undici
Ubuntu:26.10
 All versions, plus listed versions
7.18.2+dfsg+~cs3.2.0-1build17.24.6+dfsg+~cs3.2.0-38.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
 None known
node-undici
Ubuntu:26.04:LTS
 All versions, plus listed versions
7.3.0+dfsg1+~cs24.12.11-27.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-17.18.2+dfsg+~cs3.2.0-1build1
 None known
nodejs16
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 16.17.0-2.1
16.17.0-2.1

History

History
RecordedChangedSources
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-31150 is a medium vulnerability (CVSS 5.3) in Nodejs Undici, published July 19, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.52%, the 74th percentile. Fixed in undici 5.8.0.

References

Show 18 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open