CVE-2022-31150: Improper Neutralization of CRLF Sequences ('CRLF Injection')

July 19, 2022 (updated October 28, 2022)

undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate \r\n is a workaround for this issue.

References

github.com/advisories/GHSA-3cvr-822r-rqcc
github.com/nodejs/undici/commit/a29a151d0140d095742d21a004023d024fe93259
github.com/nodejs/undici/releases/tag/v5.8.0
github.com/nodejs/undici/security/advisories/GHSA-3cvr-822r-rqcc
hackerone.com/reports/409943
nvd.nist.gov/vuln/detail/CVE-2022-31150

Code Behaviors & Features

Detect and mitigate CVE-2022-31150 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →