{"id":"CVE-2022-35948","aliases":["GHSA-f772-66g8-q5h3"],"url":"https://o3.security/vulnerability/CVE-2022-35948","summary":"CRLF Injection in Nodejs ‘undici’ via Content-Type","details":"undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specifically, inside the `content-type` header. Example: ``` import { request } from 'undici' const unsanitizedContentTypeInput = 'application/json\\r\\n\\r\\nGET /foo2 HTTP/1.1' await request('http://localhost:3000, { method: 'GET', headers: { 'content-type': unsanitizedContentTypeInput }, }) ``` The above snippet will perform two requests in a single `request` API call: 1) `http://localhost:3000/` 2) `http://localhost:3000/foo2` This issue was patched in Undici v5.8.1. Sanitize input when sending content-type headers using user input as a workaround.","published":"2022-08-13T00:00:00Z","modified":"2026-08-08T03:47:29.389482536Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"npm","name":"undici","fixedVersion":"5.8.2"}],"fix":{"url":"https://github.com/nodejs/undici/commit/66165d604fd0aee70a93ed5c44ad4cc2df395f80","label":"nodejs/undici@66165d6"},"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v5.8.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35948.json"},{"type":"ADVISORY","url":"https://github.com/nodejs/undici/security/advisories/GHSA-f772-66g8-q5h3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35948"},{"type":"FIX","url":"https://github.com/nodejs/undici/commit/66165d604fd0aee70a93ed5c44ad4cc2df395f80"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-08T03:47:29.389482536Z"}}