CVE-2022-31150

Name	CVE-2022-31150
Description	undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate `\r\n` is a workaround for this issue.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
node-undici (PTS)	bookworm, bookworm (security)	5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3	fixed
	sid, trixie	5.28.4+dfsg1+~cs23.12.11-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
node-undici	source	(unstable)	5.8.0+dfsg1+~cs18.9.16-1

Notes

https://github.com/nodejs/undici/security/advisories/GHSA-3cvr-822r-rqcc
https://hackerone.com/reports/409943
https://github.com/nodejs/undici/releases/tag/v5.8.0