CVE-2026-1527
Fixed in a distro release EPSS <1%CVSS 4.6
ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary HTTP headers * Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch) The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters: // lib/dispatcher/client-h1.js:1121 if (upgrade) { header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n` }
Products: undici
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | undici | 6.24.0 |
| npm | undici | 7.24.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 10 | nodejs24-docs | 1:24.14.1-2.el10_1 |
| AlmaLinux 10 | nodejs24-npm | 1:11.11.0-1.24.14.1.2.el10_1 |
| AlmaLinux 8 | nodejs | 1:24.14.1-2.module_el8.10.0+4160+4819ac42 |
| AlmaLinux 8 | nodejs-devel | 1:24.14.1-2.module_el8.10.0+4160+4819ac42 |
| AlmaLinux 8 | nodejs-docs | 1:24.14.1-2.module_el8.10.0+4160+4819ac42 |
| AlmaLinux 8 | nodejs-full-i18n | 1:24.14.1-2.module_el8.10.0+4160+4819ac42 |
| AlmaLinux 8 | nodejs-libs | 1:24.14.1-2.module_el8.10.0+4160+4819ac42 |
| AlmaLinux 8 | nodejs-nodemon | 3.0.3-1.module_el8.10.0+4061+f8ceeab9 |
| AlmaLinux 8 | nodejs-packaging | 2021.06-6.module_el8.10.0+4086+70facd4a |
| AlmaLinux 8 | nodejs-packaging-bundler | 2021.06-6.module_el8.10.0+4086+70facd4a |
| AlmaLinux 8 | npm | 1:11.11.0-1.24.14.1.2.module_el8.10.0+4160+4819ac42 |
| AlmaLinux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42 |
| AlmaLinux 9 | nodejs | 1:24.14.1-2.module_el9.7.0+222+ef1c61e1 |
| AlmaLinux 9 | nodejs-devel | 1:24.14.1-2.module_el9.7.0+222+ef1c61e1 |
| AlmaLinux 9 | nodejs-docs | 1:24.14.1-2.module_el9.7.0+222+ef1c61e1 |
| AlmaLinux 9 | nodejs-full-i18n | 1:24.14.1-2.module_el9.7.0+222+ef1c61e1 |
| AlmaLinux 9 | nodejs-libs | 1:24.14.1-2.module_el9.7.0+222+ef1c61e1 |
| AlmaLinux 9 | nodejs-nodemon | 3.0.3-3.module_el9.7.0+209+ecf6523e |
| AlmaLinux 9 | nodejs-packaging | 2021.06-6.module_el9.7.0+209+ecf6523e |
| AlmaLinux 9 | nodejs-packaging-bundler | 2021.06-6.module_el9.7.0+198+8bf605ba |
| AlmaLinux 9 | npm | 1:11.11.0-1.24.14.1.2.module_el9.7.0+222+ef1c61e1 |
| AlmaLinux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.14.1.2.module_el9.7.0+222+ef1c61e1 |
| Chainguard | code-server | 4.110.1-r2 |
| Chainguard | gemini-cli | 0.49.0-r4 |
| Chainguard | jitsucom-jitsu-console | 2.11.0-r17 |
| Chainguard | jitsucom-jitsu-rotor | 2.11.0-r17 |
| Chainguard | kibana-8.17 | 8.17.10-r13 |
| Chainguard | kibana-8.17-bitnami | 8.17.10-r13 |
| Chainguard | kibana-8.17-iamguarded | 8.17.10-r13 |
| Chainguard | kibana-8.18 | 8.18.8-r11 |
| Chainguard | kibana-8.18-bitnami | 8.18.8-r11 |
| Chainguard | kibana-8.18-iamguarded | 8.18.8-r11 |
| Chainguard | kibana-8.19 | 8.19.13-r4 |
| Chainguard | kibana-8.19-bitnami | 8.19.13-r4 |
| Chainguard | kibana-8.19-iamguarded | 8.19.13-r4 |
| Chainguard | kibana-9.0 | 9.0.8-r14 |
| Chainguard | kibana-9.0-bitnami | 9.0.8-r14 |
| Chainguard | kibana-9.0-iamguarded | 9.0.8-r14 |
| Chainguard | kibana-9.1 | 9.1.10-r7 |
| Chainguard | kibana-9.1-iamguarded | 9.1.10-r7 |
| Chainguard | kibana-9.2 | 9.2.7-r0 |
| Chainguard | kibana-9.2 | 9.2.6-r3 |
| Chainguard | kibana-9.2-iamguarded | 9.2.6-r3 |
| Chainguard | kibana-9.3 | 9.3.2-r0 |
| Chainguard | kibana-9.3-iamguarded | 9.3.2-r0 |
| Chainguard | kibana-9.3-iamguarded | 9.3.1-r2 |
| Chainguard | langfuse-3-worker | 3.179.1-r1 |
| Chainguard | langfuse-fips-3-worker | 3.179.1-r1 |
| Chainguard | langfuse-fips-3.152-worker | no fix |
| Chainguard | librechat | 0.8.4-r3 |
| Chainguard | pelias-api | 7.6.0-r4 |
| Chainguard | renovate | 43.84.0-r1 |
| Debian 13 | node-undici | no fix |
| Debian 14 | node-undici | 7.24.5+dfsg+~cs3.2.0-1 |
| Red Hat Enterprise Linux 10.1 | nodejs24 | 1:24.14.1-2.el10_1 |
| Red Hat Enterprise Linux 10.1 | nodejs24-debuginfo | 1:24.14.1-2.el10_1 |
| Red Hat Enterprise Linux 10.1 | nodejs24-debugsource | 1:24.14.1-2.el10_1 |
| Red Hat Enterprise Linux 10.1 | nodejs24-devel | 1:24.14.1-2.el10_1 |
| Red Hat Enterprise Linux 10.1 | nodejs24-docs | 1:24.14.1-2.el10_1 |
| Red Hat Enterprise Linux 10.1 | nodejs24-full-i18n | 1:24.14.1-2.el10_1 |
| Red Hat Enterprise Linux 10.1 | nodejs24-libs | 1:24.14.1-2.el10_1 |
| Red Hat Enterprise Linux 10.1 | nodejs24-libs-debuginfo | 1:24.14.1-2.el10_1 |
| Red Hat Enterprise Linux 10.1 | nodejs24-npm | 1:11.11.0-1.24.14.1.2.el10_1 |
| Red Hat Enterprise Linux 8 | nodejs | 1:24.14.1-2.module+el8.10.0+24190+49a46c75 |
| Red Hat Enterprise Linux 8 | nodejs-debuginfo | 1:24.14.1-2.module+el8.10.0+24190+49a46c75 |
| Red Hat Enterprise Linux 8 | nodejs-debugsource | 1:24.14.1-2.module+el8.10.0+24190+49a46c75 |
| Red Hat Enterprise Linux 8 | nodejs-devel | 1:24.14.1-2.module+el8.10.0+24190+49a46c75 |
| Red Hat Enterprise Linux 8 | nodejs-docs | 1:24.14.1-2.module+el8.10.0+24190+49a46c75 |
| Red Hat Enterprise Linux 8 | nodejs-full-i18n | 1:24.14.1-2.module+el8.10.0+24190+49a46c75 |
| Red Hat Enterprise Linux 8 | nodejs-libs | 1:24.14.1-2.module+el8.10.0+24190+49a46c75 |
| Red Hat Enterprise Linux 8 | nodejs-libs-debuginfo | 1:24.14.1-2.module+el8.10.0+24190+49a46c75 |
| Red Hat Enterprise Linux 8 | nodejs-nodemon | 0:3.0.3-1.module+el8.10.0+24190+49a46c75 |
| Red Hat Enterprise Linux 8 | nodejs-packaging | 0:2021.06-6.module+el8.10.0+24190+49a46c75 |
| Red Hat Enterprise Linux 8 | nodejs-packaging-bundler | 0:2021.06-6.module+el8.10.0+24190+49a46c75 |
| Red Hat Enterprise Linux 8 | npm | 1:11.11.0-1.24.14.1.2.module+el8.10.0+24190+49a46c75 |
| Red Hat Enterprise Linux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.14.1.2.module+el8.10.0+24190+49a46c75 |
| Red Hat Enterprise Linux 9 | nodejs | 1:24.14.1-2.module+el9.7.0+24166+51c9666b |
| Red Hat Enterprise Linux 9 | nodejs-debuginfo | 1:24.14.1-2.module+el9.7.0+24166+51c9666b |
| Red Hat Enterprise Linux 9 | nodejs-debugsource | 1:24.14.1-2.module+el9.7.0+24166+51c9666b |
| Red Hat Enterprise Linux 9 | nodejs-devel | 1:24.14.1-2.module+el9.7.0+24166+51c9666b |
| Red Hat Enterprise Linux 9 | nodejs-docs | 1:24.14.1-2.module+el9.7.0+24166+51c9666b |
| Red Hat Enterprise Linux 9 | nodejs-full-i18n | 1:24.14.1-2.module+el9.7.0+24166+51c9666b |
| Red Hat Enterprise Linux 9 | nodejs-libs | 1:24.14.1-2.module+el9.7.0+24166+51c9666b |
| Red Hat Enterprise Linux 9 | nodejs-libs-debuginfo | 1:24.14.1-2.module+el9.7.0+24166+51c9666b |
| Red Hat Enterprise Linux 9 | nodejs-nodemon | 0:3.0.3-3.module+el9.7.0+24166+51c9666b |
| Red Hat Enterprise Linux 9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+24166+51c9666b |
| Red Hat Enterprise Linux 9 | nodejs-packaging-bundler | 0:2021.06-6.module+el9.7.0+24166+51c9666b |
| Red Hat Enterprise Linux 9 | npm | 1:11.11.0-1.24.14.1.2.module+el9.7.0+24166+51c9666b |
| Red Hat Enterprise Linux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.14.1.2.module+el9.7.0+24166+51c9666b |
| Rocky Linux 10 | nodejs24 | 1:24.14.1-2.el10_1 |
| Rocky Linux 8 | nodejs-nodemon | 0:3.0.3-1.module+el8.10.0+2084+ab509703 |
| Rocky Linux 8 | nodejs-packaging | 0:2021.06-6.module+el8.10.0+40048+6d99f608 |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+40052+e32ea525 |
| Ubuntu 24.04 LTS | node-undici | no fix |
| Ubuntu 25.10 | node-undici | no fix |
| Ubuntu 26.04 LTS | node-undici | no fix |
| Ubuntu 26.10 | node-undici | no fix |
| Wolfi | code-server | 4.110.1-r2 |
| Wolfi | jitsucom-jitsu-console | 2.11.0-r17 |
| Wolfi | jitsucom-jitsu-rotor | 2.11.0-r17 |
| Wolfi | langfuse-3-worker | 3.179.1-r1 |
| Wolfi | renovate | 43.84.0-r1 |