{"id":"CVE-2022-35948","aliases":["CLSA-2026-1788560495","DEBIAN-CVE-2022-35948","EUVD-2022-6547","GHSA-f772-66g8-q5h3","SUSE-SU-2022:3196-1","SUSE-SU-2022:3250-1","SUSE-SU-2022:3251-1"],"status":"published","title":"CRLF Injection in Nodejs ‘undici’ via Content-Type","description":"undici is an HTTP/1.1 client, written from scratch for Node.js.`=\u003c undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specifically, inside the `content-type` header. Example: ``` import { request } from 'undici' const unsanitizedContentTypeInput = 'application/json\\r\\n\\r\\nGET /foo2 HTTP/1.1' await request('http://localhost:3000, { method: 'GET', headers: { 'content-type': unsanitizedContentTypeInput }, }) ``` The above snippet will perform two requests in a single `request` API call: 1) `http://localhost:3000/` 2) `http://localhost:3000/foo2` This issue was patched in Undici v5.8.1. Sanitize input when sending content-type headers using user input as a workaround.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.01391,"percentile":0.72519,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74","CWE-93"],"published":"2022-08-13T00:00:00Z","modified":"2026-11-03T08:04:09Z","fixes":[{"ecosystem":"npm","package":"undici","fixed_in":["5.8.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"node-undici","fixed_in":["5.8.2+dfsg1+~cs18.9.18.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-undici","fixed_in":["5.8.2+dfsg1+~cs18.9.18.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-undici","fixed_in":["5.8.2+dfsg1+~cs18.9.18.1-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.8.1"},{"fixed":"5.8.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.1-tuxcare.0"},{"fixed":"5.5.1-tuxcare.1"}]}],"versions":["5.5.1"],"bundled":14},{"source":"osv","ecosystem":"Debian:12","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.2+dfsg1+~cs18.9.18.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.2+dfsg1+~cs18.9.18.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.2+dfsg1+~cs18.9.18.1-1"}]}]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.8.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.17.0-8.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP4","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.17.0-150400.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.17.0-150400.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP3","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.17.0-150300.7.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.17.0-150300.7.9.1"}]}],"bundled":4}],"products":[{"vendor":"nodejs","product":"undici"},{"vendor":"undici","product":"undici"}],"references":[{"url":"https://github.com/nodejs/undici/releases/tag/v5.8.2","tags":["x_transferred","Release Notes","Third Party Advisory","web"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-f772-66g8-q5h3","tags":["x_transferred","Exploit","Third Party Advisory","advisory","web"]},{"url":"https://github.com/nodejs/undici/commit/66165d604fd0aee70a93ed5c44ad4cc2df395f80","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35948","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f772-66g8-q5h3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35948.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-35948","tags":["advisory"]},{"url":"https://github.com/nodejs/undici","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223196-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1200303","tags":["report"]},{"url":"https://bugzilla.suse.com/1200517","tags":["report"]},{"url":"https://bugzilla.suse.com/1201710","tags":["report"]},{"url":"https://bugzilla.suse.com/1202382","tags":["report"]},{"url":"https://bugzilla.suse.com/1202383","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-35948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-35949","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223250-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223251-1/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-35948","title":"CRLF Injection in Nodejs ‘undici’ via Content-Type","description":"undici is an HTTP/1.1 client, written from scratch for Node.js.`=\u003c undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specifically, inside the `content-type` header. Example: ``` import { request } from 'undici' const unsanitizedContentTypeInput = 'application/json\\r\\n\\r\\nGET /foo2 HTTP/1.1' await request('http://localhost:3000, { method: 'GET', headers: { 'content-type': unsanitizedContentTypeInput }, }) ``` The above snippet will perform two requests in a single `request` API call: 1) `http://localhost:3000/` 2) `http://localhost:3000/foo2` This issue was patched in Undici v5.8.1. Sanitize input when sending content-type headers using user input as a workaround.","status":"published","published":"2022-08-13T00:00:00Z","modified":"2025-04-22T17:42:05.598Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-93","CWE-74"],"updated_at":"2026-11-02T14:34:39.935681Z"}],"euvd":[{"id":"EUVD-2022-6547","description":"undici is an HTTP/1.1 client, written from scratch for Node.js.`=\u003c undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specifically, inside the `content-type` header. Example: ``` import { request } from 'undici' const unsanitizedContentTypeInput = 'application/json\\r\\n\\r\\nGET /foo2 HTTP/1.1' await request('http://localhost:3000, { method: 'GET', headers: { 'content-type': unsanitizedContentTypeInput }, }) ``` The above snippet will perform two requests in a single `request` API call: 1) `http://localhost:3000/` 2) `http://localhost:3000/foo2` This issue was patched in Undici v5.8.1. Sanitize input when sending content-type headers using user input as a workaround.","status":"published","published":"2022-08-13T00:00:00Z","modified":"2025-04-22T17:42:05Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:16.055056Z"}],"ghsa":[{"id":"GHSA-f772-66g8-q5h3","title":"Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type","description":"### Impact\n\n`=\u003c undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specifically, inside the `content-type` header.\n\nExample:\n\n```\nimport { request } from 'undici'\n\nconst unsanitizedContentTypeInput =  'application/json\\r\\n\\r\\nGET /foo2 HTTP/1.1'\n\nawait request('http://localhost:3000, {\n    method: 'GET',\n    headers: {\n      'content-type': unsanitizedContentTypeInput\n    },\n})\n```\n\nThe above snippet will perform two requests in a single `request` API call:\n\n1) `http://localhost:3000/`\n2) `http://localhost:3000/foo2`\n\n### Patches\n\nThis issue was patched in Undici v5.8.1\n\n### Workarounds\n\nSanitize input when sending content-type headers using user input.\n\n## For more information\nIf you have any questions or comments about this advisory:\n\n- Open an issue in [undici repository](https://github.com/nodejs/undici/issues)\n- To make a report, follow the [SECURITY](https://github.com/nodejs/node/blob/HEAD/SECURITY.md) document","status":"published","published":"2022-08-18T19:02:56Z","modified":"2023-02-03T05:04:25Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-74","CWE-93"],"updated_at":"2026-11-02T14:36:41.967989Z"}],"nvd":[{"id":"CVE-2022-35948","description":"undici is an HTTP/1.1 client, written from scratch for Node.js.`=\u003c undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specifically, inside the `content-type` header. Example: ``` import { request } from 'undici' const unsanitizedContentTypeInput = 'application/json\\r\\n\\r\\nGET /foo2 HTTP/1.1' await request('http://localhost:3000, { method: 'GET', headers: { 'content-type': unsanitizedContentTypeInput }, }) ``` The above snippet will perform two requests in a single `request` API call: 1) `http://localhost:3000/` 2) `http://localhost:3000/foo2` This issue was patched in Undici v5.8.1. Sanitize input when sending content-type headers using user input as a workaround.","status":"published","published":"2022-08-15T11:21:38.353Z","modified":"2026-06-17T04:52:35.033Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-74","CWE-93"],"updated_at":"2026-11-02T14:07:25.242752Z"}],"osv":[{"id":"CVE-2022-35948","title":"CRLF Injection in Nodejs ‘undici’ via Content-Type","description":"undici is an HTTP/1.1 client, written from scratch for Node.js.`=\u003c undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specifically, inside the `content-type` header. Example: ``` import { request } from 'undici' const unsanitizedContentTypeInput = 'application/json\\r\\n\\r\\nGET /foo2 HTTP/1.1' await request('http://localhost:3000, { method: 'GET', headers: { 'content-type': unsanitizedContentTypeInput }, }) ``` The above snippet will perform two requests in a single `request` API call: 1) `http://localhost:3000/` 2) `http://localhost:3000/foo2` This issue was patched in Undici v5.8.1. Sanitize input when sending content-type headers using user input as a workaround.","status":"published","published":"2022-08-13T00:00:00Z","modified":"2026-10-28T02:30:35.878823028Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-74","CWE-93"],"updated_at":"2026-11-02T15:44:26.195407Z"},{"id":"DEBIAN-CVE-2022-35948","description":"undici is an HTTP/1.1 client, written from scratch for Node.js.`=\u003c undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specifically, inside the `content-type` header. Example: ``` import { request } from 'undici' const unsanitizedContentTypeInput = 'application/json\\r\\n\\r\\nGET /foo2 HTTP/1.1' await request('http://localhost:3000, { method: 'GET', headers: { 'content-type': unsanitizedContentTypeInput }, }) ``` The above snippet will perform two requests in a single `request` API call: 1) `http://localhost:3000/` 2) `http://localhost:3000/foo2` This issue was patched in Undici v5.8.1. Sanitize input when sending content-type headers using user input as a workaround.","status":"published","published":"2022-08-15T11:21:38.353Z","modified":"2026-11-03T08:04:09.118064334Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T08:23:07.763774Z"},{"id":"GHSA-f772-66g8-q5h3","title":"Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type","description":"### Impact\n\n`=\u003c undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specifically, inside the `content-type` header.\n\nExample:\n\n```\nimport { request } from 'undici'\n\nconst unsanitizedContentTypeInput =  'application/json\\r\\n\\r\\nGET /foo2 HTTP/1.1'\n\nawait request('http://localhost:3000, {\n    method: 'GET',\n    headers: {\n      'content-type': unsanitizedContentTypeInput\n    },\n})\n```\n\nThe above snippet will perform two requests in a single `request` API call:\n\n1) `http://localhost:3000/`\n2) `http://localhost:3000/foo2`\n\n### Patches\n\nThis issue was patched in Undici v5.8.1\n\n### Workarounds\n\nSanitize input when sending content-type headers using user input.\n\n## For more information\nIf you have any questions or comments about this advisory:\n\n- Open an issue in [undici repository](https://github.com/nodejs/undici/issues)\n- To make a report, follow the [SECURITY](https://github.com/nodejs/node/blob/HEAD/SECURITY.md) document","status":"published","published":"2022-08-18T19:02:56Z","modified":"2023-11-08T04:09:53.836338Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-74","CWE-93"],"updated_at":"2026-11-02T15:46:46.006631Z"},{"id":"CLSA-2026-1788560495","title":"TuxCare security update for undici (14 CVEs)","description":"TuxCare rebuilt undici to address 14 CVEs. Fixed in 5.5.1-tuxcare.1.","status":"published","published":"2026-09-04T22:21:35Z","modified":"2026-10-15T09:48:03.135244229Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"SUSE-SU-2022:3196-1","title":"Security update for nodejs16","description":"This update for nodejs16 fixes the following issues:\n\n- CVE-2022-35949: Fixed SSRF when an application takes in user input into the path/pathname option of undici.request (bsc#1202382).\n- CVE-2022-35948: Fixed CRLF injection via Content-Type (bsc#1202383).\n- CVE-2022-29244: Fixed npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (bsc#1200517).\n- CVE-2022-31150: Fixed CRLF injection in node-undici (bsc#1201710).\n\nBugfixes:\n\n- Enable crypto-policies for SLE15 SP4+ and TW (bsc#1200303)\n","status":"published","published":"2022-09-08T08:35:42Z","modified":"2026-02-04T04:06:40.438354Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:3250-1","title":"Security update for nodejs16","description":"This update for nodejs16 fixes the following issues:\n\n- CVE-2022-35949: Fixed SSRF when an application takes in user input into the path/pathname option of undici.request (bsc#1202382).\n- CVE-2022-35948: Fixed CRLF injection via Content-Type (bsc#1202383).\n- CVE-2022-29244: Fixed npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (bsc#1200517).\n- CVE-2022-31150: Fixed CRLF injection in node-undici (bsc#1201710).\n\nBugfixes:\n\n- Enable crypto-policies for SLE15 SP4+ and TW (bsc#1200303)\n","status":"published","published":"2022-09-12T07:06:54Z","modified":"2026-02-04T04:01:38.008685Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:3251-1","title":"Security update for nodejs16","description":"This update for nodejs16 fixes the following issues:\n\n- CVE-2022-35949: Fixed SSRF when an application takes in user input into the path/pathname option of undici.request (bsc#1202382).\n- CVE-2022-35948: Fixed CRLF injection via Content-Type (bsc#1202383).\n- CVE-2022-29244: Fixed npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (bsc#1200517).\n- CVE-2022-31150: Fixed CRLF injection in node-undici (bsc#1201710).\n\nBugfixes:\n\n- Enable crypto-policies for SLE15 SP4+ and TW (bsc#1200303)\n","status":"published","published":"2022-09-12T07:07:06Z","modified":"2026-02-04T04:04:13.518338Z","updated_at":"2026-11-02T15:53:50.965375Z"}]}}