GHSA-4992-7rv2-5pvq
Medium · 4.6CVSS
4.6
EPSS
—
Published
Mar 13, 2026
CISA due date
—
The record
Undici has CRLF Injection in undici via `upgrade` option
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | undici | 0 | 6.24.0 |
| npm | undici | 7.0.0 | 7.24.0 |
| Chainguard | code-server | 0 | 4.110.1-r2 |
| Chainguard | jitsucom-jitsu-console | 0 | 2.11.0-r17 |
| Chainguard | jitsucom-jitsu-rotor | 0 | 2.11.0-r17 |
| Chainguard | kibana-8.17 | 0 | 8.17.10-r13 |
| Chainguard | kibana-8.17-bitnami | 0 | 8.17.10-r13 |
| Chainguard | kibana-8.17-iamguarded | 0 | 8.17.10-r13 |
| Chainguard | kibana-8.18 | 0 | 8.18.8-r11 |
| Chainguard | kibana-8.18-bitnami | 0 | 8.18.8-r11 |
| Chainguard | kibana-8.18-iamguarded | 0 | 8.18.8-r11 |
| Chainguard | kibana-8.19 | 0 | 8.19.13-r4 |
| Chainguard | kibana-8.19-bitnami | 0 | 8.19.13-r4 |
| Chainguard | kibana-8.19-iamguarded | 0 | 8.19.13-r4 |
| Chainguard | kibana-9.0 | 0 | 9.0.8-r14 |
| Chainguard | kibana-9.0-bitnami | 0 | 9.0.8-r14 |
| Chainguard | kibana-9.0-iamguarded | 0 | 9.0.8-r14 |
| Chainguard | kibana-9.1 | 0 | 9.1.10-r7 |
| Chainguard | kibana-9.1-iamguarded | 0 | 9.1.10-r7 |
| Chainguard | kibana-9.2 | 0 | 9.2.7-r0 |
| Chainguard | kibana-9.2-iamguarded | 0 | 9.2.6-r3 |
| Chainguard | kibana-9.3 | 0 | 9.3.2-r0 |
| Chainguard | kibana-9.3-iamguarded | 0 | 9.3.2-r0 |
| Chainguard | pelias-api | 0 | 7.6.0-r4 |
| Chainguard | renovate | 0 | 43.84.0-r1 |
| Wolfi | code-server | 0 | 4.110.1-r2 |
| Wolfi | jitsucom-jitsu-console | 0 | 2.11.0-r17 |
| Wolfi | jitsucom-jitsu-rotor | 0 | 2.11.0-r17 |
| Wolfi | renovate | 0 | 43.84.0-r1 |
Related vulnerabilities
- CVE-2026-1527 ImpactWhen an application passes user-controlled input to the upgrade option of… Same vulnerability
- GHSA-g8m3-5g58-fq7m undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring… Also affects undici
- GHSA-vxpw-j846-p89q undici WebSocket client vulnerable to denial of service via fragment count bypass Also affects undici
- GHSA-p88m-4jfj-68fv undici vulnerable to HTTP header injection via Set-Cookie percent-decoding Also affects undici
- GHSA-hm92-r4w5-c3mj undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse Also affects undici
- GHSA-35p6-xmwp-9g52 undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse Also affects undici
- GHSA-vmh5-mc38-953g undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5… Also affects undici
- GHSA-pr7r-676h-xcf6 undici vulnerable to cross-user information disclosure via shared cache whitespace bypass Also affects undici