https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 10:03:02 +0000 https://cve.radiocsirt.org/vuln/cve-2022-35948 <p><strong>Affected:</strong> nodejs undici</p> <p>undici is an HTTP/1.1 client, written from scratch for Node.js.`=&lt; undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specifically, inside the `content-type` header. Example: ``` import { request } from &#39;undici&#39; const unsanitizedContentTypeInput = &#39;application/json\r\n\r\nGET /foo2 HTTP/1.1&#39; await request(&#39;http://localhost:3000, { method: &#39;GET&#39;, headers: { &#39;content-type&#39;: unsanitizedContentTypeInput }, }) ``` The above snippet will perform two requests in a single `request` API call: 1) `http://localhost:3000/` 2) `http://localhost:3000/foo2` This issue was patched in Undici v5.8.1. Sanitize input when sending content-type headers using user input as a workaround.</p> <p><strong>Affected:</strong> nodejs undici</p> <p>undici is an HTTP/1.1 client, written from scratch for Node.js.`=&lt; undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specifically, inside the `content-type` header. Example: ``` import { request } from &#39;undici&#39; const unsanitizedContentTypeInput = &#39;application/json\r\n\r\nGET /foo2 HTTP/1.1&#39; await request(&#39;http://localhost:3000, { method: &#39;GET&#39;, headers: { &#39;content-type&#39;: unsanitizedContentTypeInput }, }) ``` The above snippet will perform two requests in a single `request` API call: 1) `http://localhost:3000/` 2) `http://localhost:3000/foo2` This issue was patched in Undici v5.8.1. Sanitize input when sending content-type headers using user input as a workaround.</p> https://cve.radiocsirt.org/vuln/cve-2022-35948