{
  "cveId": "CVE-2022-35948",
  "url": "https://patchblox.com/security/cve/CVE-2022-35948",
  "summary": "CVE-2022-35948 is fixed in node-undici on 1 platform, first by DEBIAN-CVE-2022-35948, released August 15, 2022. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "node-undici: undici is an HTTP/1.1 client, written from scratch for Node.js.\u0060=\u003C undici@5.8.0\u0060 users are vulnerable to _CRLF Inject...",
  "description": "undici is an HTTP/1.1 client, written from scratch for Node.js.\u0060=\u003C undici@5.8.0\u0060 users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specifically, inside the \u0060content-type\u0060 header. Example: \u0060\u0060\u0060 import { request } from \u0027undici\u0027 const unsanitizedContentTypeInput = \u0027application/json\\r\\n\\r\\nGET /foo2 HTTP/1.1\u0027 await request(\u0027http://localhost:3000, { method: \u0027GET\u0027, headers: { \u0027content-type\u0027: unsanitizedContentTypeInput }, }) \u0060\u0060\u0060 The above snippet will perform two requests in a single \u0060request\u0060 API call: 1) \u0060http://localhost:3000/\u0060 2) \u0060http://localhost:3000/foo2\u0060 This issue was patched in Undici v5.8.1. Sanitize input when sending content-type headers using user input as a workaround.",
  "published": "2022-08-15T11:21:38Z",
  "severity": "medium",
  "cvss": 5.3,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "epss": 0.01391,
  "epssPercentile": 0.72498,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "node-undici",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.8.2\u002Bdfsg1\u002B~cs18.9.18.1-1",
      "fix": "DEBIAN-CVE-2022-35948",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-35948",
      "released": "2022-08-15T11:21:38Z"
    },
    {
      "platform": "linux",
      "product": "node-undici",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.8.2\u002Bdfsg1\u002B~cs18.9.18.1-1",
      "fix": "DEBIAN-CVE-2022-35948",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-35948",
      "released": "2022-08-15T11:21:38Z"
    },
    {
      "platform": "linux",
      "product": "node-undici",
      "release": "Debian 14",
      "fixedVersion": "5.8.2\u002Bdfsg1\u002B~cs18.9.18.1-1",
      "fix": "DEBIAN-CVE-2022-35948",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-35948",
      "released": "2022-08-15T11:21:38Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T18:46:35Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}