CVE-2022-31150

NameCVE-2022-31150
Descriptionundici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate `\r\n` is a workaround for this issue.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
node-undici (PTS)bookworm5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4fixed
bookworm (security)5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3fixed
sid, trixie5.28.4+dfsg1+~cs23.12.11-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
node-undicisource(unstable)5.8.0+dfsg1+~cs18.9.16-1

Notes

https://github.com/nodejs/undici/security/advisories/GHSA-3cvr-822r-rqcc
https://hackerone.com/reports/409943
https://github.com/nodejs/undici/releases/tag/v5.8.0

Search for package or bug name: Reporting problems