{"id":"CVE-2022-35948","aliases":["GHSA-f772-66g8-q5h3"],"url":"https://o3.security/vulnerability/CVE-2022-35948","summary":"CRLF Injection in Nodejs ‘undici’ via Content-Type","details":"### Impact\n\n`=< undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specifically, inside the `content-type` header.\n\nExample:\n\n```\nimport { request } from 'undici'\n\nconst unsanitizedContentTypeInput =  'application/json\\r\\n\\r\\nGET /foo2 HTTP/1.1'\n\nawait request('http://localhost:3000, {\n    method: 'GET',\n    headers: {\n      'content-type': unsanitizedContentTypeInput\n    },\n})\n```\n\nThe above snippet will perform two requests in a single `request` API call:\n\n1) `http://localhost:3000/`\n2) `http://localhost:3000/foo2`\n\n### Patches\n\nThis issue was patched in Undici v5.8.1\n\n### Workarounds\n\nSanitize input when sending content-type headers using user input.\n\n## For more information\nIf you have any questions or comments about this advisory:\n\n- Open an issue in [undici repository](https://github.com/nodejs/undici/issues)\n- To make a report, follow the [SECURITY](https://github.com/nodejs/node/blob/HEAD/SECURITY.md) document","published":"2022-08-13T00:00:00Z","modified":"2026-08-12T03:51:36.301997544Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},"epss":{"score":0.01533,"percentile":0.72458,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"npm","name":"undici","fixedVersion":"5.8.2"}],"fix":{"url":"https://github.com/nodejs/undici/commit/66165d604fd0aee70a93ed5c44ad4cc2df395f80","label":"nodejs/undici@66165d6"},"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v5.8.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35948.json"},{"type":"ADVISORY","url":"https://github.com/nodejs/undici/security/advisories/GHSA-f772-66g8-q5h3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35948"},{"type":"FIX","url":"https://github.com/nodejs/undici/commit/66165d604fd0aee70a93ed5c44ad4cc2df395f80"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:36.301997544Z"}}