Lucene search
Veracode Vulnerability DatabaseVERACODE:36716HistoryAug 15, 2022 - 3:46 p.m.
CRLF Injection
2022-08-1515:46:22
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
25
undici
crlf injection
vulnerability
content-type
api call
0.001 Low
EPSS
Percentile
34.1%
Undici is is vulnerable to CRLF injection. The vulnerability is due to improper request header content-type sanitization in lib/core/request.js. An attacker can exploit this vulnerability to preform two requests in a single API call.
References
github.com/nodejs/undici/commit/66165d604fd0aee70a93ed5c44ad4cc2df395f80
github.com/nodejs/undici/commit/66165d604fd0aee70a93ed5c44ad4cc2df395f80#diff-7d30f7ef62c49f60ef5b01576ca8898402aa790a09c623b13f9e0ea090fba7e6R300-R301
github.com/nodejs/undici/releases/tag/v5.8.2
github.com/nodejs/undici/security/advisories/GHSA-f772-66g8-q5h3
Related
github
github
Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type
2022-08-18 19:02:56
debiancve
debiancve
CVE-2022-35948
2022-08-15 11:21:38
ubuntucve
ubuntucve
CVE-2022-35948
2022-08-15 00:00:00
redhatcve
redhatcve
CVE-2022-35948
2022-08-24 13:10:35
osv
osv
Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type
2022-08-18 19:02:56
CVE-2022-35948
2022-08-15 11:21:38
cve
cve
CVE-2022-35948
2022-08-15 11:21:38
cvelist
cvelist
CVE-2022-35948 CRLF Injection in Nodejs ‘undici’ via Content-Type
2022-08-13 00:00:00
prion
prion
Crlf injection
2022-08-15 11:21:00
nvd
nvd
CVE-2022-35948
2022-08-15 11:21:38
hackerone
hackerone
ibm
ibm
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2022:3251-1)
2022-09-13 00:00:00
SUSE: Security Advisory (SUSE-SU-2022:3196-1)
2022-09-09 00:00:00
openSUSE: Security Advisory for nodejs16 (SUSE-SU-2022:3251-1)
2022-09-13 00:00:00
suse
suse
Security update for nodejs16 (moderate)
2022-09-12 00:00:00
Security update for nodejs16 (moderate)
2022-09-12 00:00:00
nessus
nessus
SUSE SLES12 Security Update : nodejs16 (SUSE-SU-2022:3196-1)
2022-09-09 00:00:00
SUSE SLES15 Security Update : nodejs16 (SUSE-SU-2022:3250-1)
2022-09-13 00:00:00
SUSE SLES15 Security Update : nodejs16 (SUSE-SU-2022:3251-1)
2022-09-13 00:00:00
redhat
redhat
gentoo
gentoo
Node.js: Multiple Vulnerabilities
2024-05-08 00:00:00