{"id":"CVE-2022-31150","aliases":["CLSA-2026-1788560495","DEBIAN-CVE-2022-31150","EUVD-2022-6216","GHSA-3cvr-822r-rqcc","SUSE-SU-2022:3196-1","SUSE-SU-2022:3250-1","SUSE-SU-2022:3251-1","UBUNTU-CVE-2022-31150","openSUSE-SU-2024:12285-1"],"status":"published","title":"CRLF injection in request headers","description":"undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate `\\r\\n` is a workaround for this issue.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01515,"percentile":0.74847,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-93"],"published":"2022-07-19T20:40:10Z","modified":"2026-11-03T08:01:28Z","fixes":[{"ecosystem":"npm","package":"undici","fixed_in":["5.8.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"node-undici","fixed_in":["5.8.0+dfsg1+~cs18.9.16-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-undici","fixed_in":["5.8.0+dfsg1+~cs18.9.16-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-undici","fixed_in":["5.8.0+dfsg1+~cs18.9.16-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.1-tuxcare.0"},{"fixed":"5.5.1-tuxcare.1"}]}],"versions":["5.5.1"],"bundled":14},{"source":"osv","ecosystem":"Debian:12","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.0+dfsg1+~cs18.9.16-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.0+dfsg1+~cs18.9.16-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.0+dfsg1+~cs18.9.16-1"}]}]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.8.0"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.17.0-8.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP4","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.17.0-150400.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.17.0-150400.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP3","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.17.0-150300.7.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.17.0-150300.7.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.22.1+dfsg1+~cs20.10.10.2-1ubuntu1","5.26.3+dfsg1+~cs23.10.12-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.18.2+dfsg+~cs3.2.0-1build1","7.24.6+dfsg+~cs3.2.0-3","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.3.0+dfsg1+~cs24.12.11-2","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.18.2+dfsg+~cs3.2.0-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.17.0-2.1"}]}],"bundled":2}],"products":[{"vendor":"nodejs","product":"undici"},{"vendor":"undici","product":"undici"}],"references":[{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-3cvr-822r-rqcc","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","advisory","web","report"]},{"url":"https://hackerone.com/reports/409943","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web","report"]},{"url":"https://github.com/nodejs/undici/releases/tag/v5.8.0","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20220915-0002/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31150","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/commit/a29a151d0140d095742d21a004023d024fe93259","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3cvr-822r-rqcc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31150.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-31150","tags":["advisory"]},{"url":"https://github.com/nodejs/undici","tags":["package"]},{"url":"https://security.netapp.com/advisory/ntap-20220915-0002","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223196-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1200303","tags":["report"]},{"url":"https://bugzilla.suse.com/1200517","tags":["report"]},{"url":"https://bugzilla.suse.com/1201710","tags":["report"]},{"url":"https://bugzilla.suse.com/1202382","tags":["report"]},{"url":"https://bugzilla.suse.com/1202383","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-35948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-35949","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223250-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223251-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-31150","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-31150","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-31150","title":"CRLF injection in request headers","description":"undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate `\\r\\n` is a workaround for this issue.","status":"published","published":"2022-07-19T20:40:10Z","modified":"2025-04-22T17:48:45.328Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:34:35.279735Z"}],"euvd":[{"id":"EUVD-2022-6216","description":"undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate `\\r\\n` is a workaround for this issue.","status":"published","published":"2022-07-19T20:40:10Z","modified":"2025-04-22T17:48:45Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:15.540112Z"}],"ghsa":[{"id":"GHSA-3cvr-822r-rqcc","title":"undici before v5.8.0 vulnerable to CRLF injection in request headers","description":"### Impact\n\nIt is possible to inject CRLF sequences into request headers in Undici.\n\n```js\nconst undici = require('undici')\n\nconst response = undici.request(\"http://127.0.0.1:1000\", {\n  headers: {'a': \"\\r\\nb\"}\n})\n```\n\nThe same applies to `path` and `method`\n\n### Patches\n\nUpdate to v5.8.0\n\n### Workarounds\n\nSanitize all HTTP headers from untrusted sources to eliminate `\\r\\n`.\n\n### References\n\nhttps://hackerone.com/reports/409943\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12116\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [undici repository](https://github.com/nodejs/undici/issues)\n* To make a report, follow the [SECURITY](https://github.com/nodejs/node/blob/HEAD/SECURITY.md) document\n","status":"published","published":"2022-07-21T20:30:10Z","modified":"2023-01-27T05:02:07Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:36:17.04874Z"}],"nvd":[{"id":"CVE-2022-31150","description":"undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate `\\r\\n` is a workaround for this issue.","status":"published","published":"2022-07-19T21:15:15.16Z","modified":"2026-06-17T04:44:54.533Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:07:23.686531Z"}],"osv":[{"id":"CVE-2022-31150","title":"CRLF injection in request headers","description":"undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate `\\r\\n` is a workaround for this issue.","status":"published","published":"2022-07-19T20:40:10Z","modified":"2026-10-28T02:30:51.941329196Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T15:44:25.516981Z"},{"id":"DEBIAN-CVE-2022-31150","description":"undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate `\\r\\n` is a workaround for this issue.","status":"published","published":"2022-07-19T21:15:15.16Z","modified":"2026-11-03T08:01:28.798263318Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T08:25:01.007408Z"},{"id":"GHSA-3cvr-822r-rqcc","title":"undici before v5.8.0 vulnerable to CRLF injection in request headers","description":"### Impact\n\nIt is possible to inject CRLF sequences into request headers in Undici.\n\n```js\nconst undici = require('undici')\n\nconst response = undici.request(\"http://127.0.0.1:1000\", {\n  headers: {'a': \"\\r\\nb\"}\n})\n```\n\nThe same applies to `path` and `method`\n\n### Patches\n\nUpdate to v5.8.0\n\n### Workarounds\n\nSanitize all HTTP headers from untrusted sources to eliminate `\\r\\n`.\n\n### References\n\nhttps://hackerone.com/reports/409943\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12116\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [undici repository](https://github.com/nodejs/undici/issues)\n* To make a report, follow the [SECURITY](https://github.com/nodejs/node/blob/HEAD/SECURITY.md) document\n","status":"published","published":"2022-07-21T20:30:10Z","modified":"2023-11-08T04:09:27.728154Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T15:46:35.747385Z"},{"id":"UBUNTU-CVE-2022-31150","description":"undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate `\\r\\n` is a workaround for this issue.","status":"published","published":"2022-07-19T21:15:00Z","modified":"2026-10-17T12:56:21.922655088Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"CLSA-2026-1788560495","title":"TuxCare security update for undici (14 CVEs)","description":"TuxCare rebuilt undici to address 14 CVEs. Fixed in 5.5.1-tuxcare.1.","status":"published","published":"2026-09-04T22:21:35Z","modified":"2026-10-15T09:48:03.135244229Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"openSUSE-SU-2024:12285-1","title":"corepack16-16.17.0-2.1 on GA media","description":"These are all security issues fixed in the corepack16-16.17.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:07:32.465356Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:3196-1","title":"Security update for nodejs16","description":"This update for nodejs16 fixes the following issues:\n\n- CVE-2022-35949: Fixed SSRF when an application takes in user input into the path/pathname option of undici.request (bsc#1202382).\n- CVE-2022-35948: Fixed CRLF injection via Content-Type (bsc#1202383).\n- CVE-2022-29244: Fixed npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (bsc#1200517).\n- CVE-2022-31150: Fixed CRLF injection in node-undici (bsc#1201710).\n\nBugfixes:\n\n- Enable crypto-policies for SLE15 SP4+ and TW (bsc#1200303)\n","status":"published","published":"2022-09-08T08:35:42Z","modified":"2026-02-04T04:06:40.438354Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:3250-1","title":"Security update for nodejs16","description":"This update for nodejs16 fixes the following issues:\n\n- CVE-2022-35949: Fixed SSRF when an application takes in user input into the path/pathname option of undici.request (bsc#1202382).\n- CVE-2022-35948: Fixed CRLF injection via Content-Type (bsc#1202383).\n- CVE-2022-29244: Fixed npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (bsc#1200517).\n- CVE-2022-31150: Fixed CRLF injection in node-undici (bsc#1201710).\n\nBugfixes:\n\n- Enable crypto-policies for SLE15 SP4+ and TW (bsc#1200303)\n","status":"published","published":"2022-09-12T07:06:54Z","modified":"2026-02-04T04:01:38.008685Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:3251-1","title":"Security update for nodejs16","description":"This update for nodejs16 fixes the following issues:\n\n- CVE-2022-35949: Fixed SSRF when an application takes in user input into the path/pathname option of undici.request (bsc#1202382).\n- CVE-2022-35948: Fixed CRLF injection via Content-Type (bsc#1202383).\n- CVE-2022-29244: Fixed npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (bsc#1200517).\n- CVE-2022-31150: Fixed CRLF injection in node-undici (bsc#1201710).\n\nBugfixes:\n\n- Enable crypto-policies for SLE15 SP4+ and TW (bsc#1200303)\n","status":"published","published":"2022-09-12T07:07:06Z","modified":"2026-02-04T04:04:13.518338Z","updated_at":"2026-11-02T15:53:50.965375Z"}]}}