---
cve: "CVE-2026-1527"
severity: "MEDIUM"
cvss: 4.6
epss: "26%"
vendor: "undici"
kev: false
exploited: false
published: "2026-03-12 21:16:25"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-09-18T07:49:17+02:00"
---

# CVE-2026-1527

> 4.6 MEDIUM · 🧪 PoC

## Beschreibung

ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to:

  *  Inject arbitrary HTTP headers
  *  Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch)
The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters:

// lib/dispatcher/client-h1.js:1121
if (upgrade) {
  header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n`
}

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Erforderlich | good |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Gering | warn |
| I Integrität | Gering | warn |
| A Verfügbarkeit | Keine | good |

## Patch verfügbar (OSV)

- 8873c947271faf1ebc455bdc6158ecbc022ecfa9 (Commit)
- 07a39067a0485c1953196f500d945fe09378a176 (Commit)

## Referenzen

- <https://github.com/nodejs/undici/security/advisories/GHSA-4992-7rv2-5pvq>
- <https://hackerone.com/reports/3487198>
- <https://cna.openjsf.org/security-advisories.html>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-1527) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_