CVE-2022-31150

undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate `\r\n` is a workaround for this issue.

• CWE-93

• https://github.com/nodejs/undici/releases/tag/v5.8.0Release Notes, Third Party Advisory
• https://github.com/nodejs/undici/security/advisories/GHSA-3cvr-822r-rqccExploit, Third Party Advisory
• https://hackerone.com/reports/409943Exploit, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220915-0002/Third Party Advisory
• https://github.com/nodejs/undici/releases/tag/v5.8.0Release Notes, Third Party Advisory
• https://github.com/nodejs/undici/security/advisories/GHSA-3cvr-822r-rqccExploit, Third Party Advisory
• https://hackerone.com/reports/409943Exploit, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220915-0002/Third Party Advisory

Published

Jul 19, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31145FlyteAdmin is the control plane for Flyte responsible for ma…6.5
• CVE-2022-31146Wasmtime is a standalone runtime for WebAssembly. There is a…8.8
• CVE-2022-31147The jQuery Validation Plugin (jquery-validation) provides dr…7.5
• CVE-2022-31148Shopware is an open source e-commerce software. In versions …5.4
• CVE-2022-31149ActivityWatch open-source automated time tracker. Versions p…9.6
• CVE-2022-3115An issue was discovered in the Linux kernel through 5.16-rc6…5.5
• CVE-2022-31151Authorization headers are cleared on cross-origin redirect. …6.5
• CVE-2022-31152Synapse is an open-source Matrix homeserver written and main…7.5
• CVE-2022-31153OpenZeppelin Contracts for Cairo is a library for contract d…6.5
• CVE-2022-31154Sourcegraph is an opensource code search and navigation engi…4.3
• CVE-2022-31155Sourcegraph is an opensource code search and navigation engi…4.3
• CVE-2022-31156Gradle is a build tool. Dependency verification is a securit…4.4