[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-1527":6},{"stargazers_count":4,"fetched_at":5},7,"2026-07-31T17:19:26.604Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":27,"aliases":28,"duplicate_of":9,"upstream":30,"downstream":31,"duplicates":42,"related":43,"reserved_at":9,"published_at":46,"modified_at":47,"state":48,"summary":49,"references_raw":58,"kevs":88,"epss":89,"epss_history":92,"metrics":351,"affected":361},"CVE-2026-1527","ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\\r\\n) to:\n\n  *  Inject arbitrary HTTP headers\n  *  Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch)\nThe vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters:\n\n// lib/dispatcher/client-h1.js:1121\nif (upgrade) {\n  header += `connection: upgrade\\r\\nupgrade: ${upgrade}\\r\\n`\n}",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-93","Improper Neutralization of CRLF Sequences ('CRLF Injection')","The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.","weakness","Draft","Base",[19,23],{"id":20,"name":21,"techniques":22},"CAPEC-15","Command Delimiters",[],{"id":24,"name":25,"techniques":26},"CAPEC-81","Web Server Logs Tampering",[],[],[29],"GHSA-4992-7rv2-5pvq",[],[32,34,36,38,40],{"_key":33},"UBUNTU-CVE-2026-1527",{"_key":35},"DEBIAN-CVE-2026-1527",{"_key":37},"RHSA-2026:7350",{"_key":39},"RHSA-2026:7670",{"_key":41},"RHSA-2026:7675",[],[44],{"_key":45},"CGA-474R-8WCX-87W5","2026-03-12T20:17:18.984Z","2026-03-13T18:06:03.794Z","Analyzed",{"cisa_kev":50,"cisa_ransomware":50,"cisa_vendor":9,"epss_severity":51,"epss_score":52,"severity":53,"severity_score":54,"severity_version":55,"severity_source":56,"severity_vector":57,"severity_status":48},false,"low",0.00256,"medium",4.6,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",[59,69,74,78,83],{"url":60,"sources":61,"tags":64},"https://github.com/nodejs/undici/security/advisories/GHSA-4992-7rv2-5pvq",[56,62,63],"nvd","osv_npm",[65,66,67,68],"WEB","Mitigation","Patch","Vendor Advisory",{"url":70,"sources":71,"tags":72},"https://hackerone.com/reports/3487198",[56,62,63],[65,73],"Permissions Required",{"url":75,"sources":76,"tags":77},"https://cna.openjsf.org/security-advisories.html",[56,62,63],[65,68],{"url":79,"sources":80,"tags":81},"https://nvd.nist.gov/vuln/detail/CVE-2026-1527",[63],[82],"Advisory",{"url":84,"sources":85,"tags":86},"https://github.com/nodejs/undici",[63],[87],"PACKAGE",[],{"date":90,"score":52,"percentile":91},"2026-07-05",0.16955,[93,97,100,103,106,110,114,117,120,124,127,130,133,136,139,141,144,147,150,153,155,158,160,162,164,167,169,172,174,176,179,182,186,189,191,194,197,200,203,206,209,212,215,218,220,223,226,229,231,234,236,238,241,244,246,249,252,255,258,260,263,266,269,272,274,276,279,282,286,289,292,295,298,301,304,307,310,313,316,319,322,324,327,330,333,336,339,342,345,348],{"date":94,"score":95,"percentile":96},"2026-03-13",0.00029,0.07794,{"date":98,"score":95,"percentile":99},"2026-03-14",0.07772,{"date":101,"score":95,"percentile":102},"2026-03-15",0.07757,{"date":104,"score":95,"percentile":105},"2026-03-16",0.07735,{"date":107,"score":108,"percentile":109},"2026-03-17",0.00022,0.05584,{"date":111,"score":112,"percentile":113},"2026-03-18",0.00023,0.05688,{"date":115,"score":112,"percentile":116},"2026-03-19",0.0572,{"date":118,"score":112,"percentile":119},"2026-03-20",0.05725,{"date":121,"score":122,"percentile":123},"2026-03-21",0.00009,0.00948,{"date":125,"score":122,"percentile":126},"2026-03-22",0.00942,{"date":128,"score":122,"percentile":129},"2026-03-23",0.00941,{"date":131,"score":122,"percentile":132},"2026-03-24",0.00935,{"date":134,"score":122,"percentile":135},"2026-03-25",0.00943,{"date":137,"score":122,"percentile":138},"2026-03-26",0.00944,{"date":140,"score":122,"percentile":123},"2026-03-27",{"date":142,"score":122,"percentile":143},"2026-03-28",0.0095,{"date":145,"score":122,"percentile":146},"2026-03-29",0.00951,{"date":148,"score":122,"percentile":149},"2026-03-30",0.00945,{"date":151,"score":122,"percentile":152},"2026-03-31",0.0094,{"date":154,"score":122,"percentile":152},"2026-04-01",{"date":156,"score":122,"percentile":157},"2026-04-02",0.00946,{"date":159,"score":122,"percentile":149},"2026-04-03",{"date":161,"score":122,"percentile":157},"2026-04-04",{"date":163,"score":122,"percentile":149},"2026-04-05",{"date":165,"score":122,"percentile":166},"2026-04-06",0.00949,{"date":168,"score":122,"percentile":143},"2026-04-07",{"date":170,"score":122,"percentile":171},"2026-04-08",0.00954,{"date":173,"score":122,"percentile":143},"2026-04-09",{"date":175,"score":122,"percentile":123},"2026-04-10",{"date":177,"score":122,"percentile":178},"2026-04-11",0.00938,{"date":180,"score":122,"percentile":181},"2026-04-12",0.00934,{"date":183,"score":184,"percentile":185},"2026-04-13",0.00011,0.01235,{"date":187,"score":184,"percentile":188},"2026-04-14",0.01218,{"date":190,"score":184,"percentile":188},"2026-04-15",{"date":192,"score":184,"percentile":193},"2026-04-16",0.01228,{"date":195,"score":184,"percentile":196},"2026-04-17",0.01234,{"date":198,"score":184,"percentile":199},"2026-04-18",0.01241,{"date":201,"score":184,"percentile":202},"2026-04-19",0.01237,{"date":204,"score":184,"percentile":205},"2026-04-20",0.01232,{"date":207,"score":184,"percentile":208},"2026-04-21",0.01314,{"date":210,"score":184,"percentile":211},"2026-04-22",0.0132,{"date":213,"score":184,"percentile":214},"2026-04-23",0.01327,{"date":216,"score":184,"percentile":217},"2026-04-24",0.01321,{"date":219,"score":184,"percentile":217},"2026-04-25",{"date":221,"score":184,"percentile":222},"2026-04-26",0.01325,{"date":224,"score":184,"percentile":225},"2026-04-27",0.01333,{"date":227,"score":184,"percentile":228},"2026-04-28",0.01316,{"date":230,"score":184,"percentile":217},"2026-04-29",{"date":232,"score":184,"percentile":233},"2026-04-30",0.01318,{"date":235,"score":184,"percentile":228},"2026-05-01",{"date":237,"score":184,"percentile":228},"2026-05-02",{"date":239,"score":184,"percentile":240},"2026-05-03",0.01315,{"date":242,"score":184,"percentile":243},"2026-05-04",0.01313,{"date":245,"score":184,"percentile":208},"2026-05-05",{"date":247,"score":184,"percentile":248},"2026-05-06",0.01308,{"date":250,"score":184,"percentile":251},"2026-05-07",0.01309,{"date":253,"score":184,"percentile":254},"2026-05-08",0.0131,{"date":256,"score":184,"percentile":257},"2026-05-09",0.01305,{"date":259,"score":184,"percentile":248},"2026-05-10",{"date":261,"score":184,"percentile":262},"2026-05-11",0.01302,{"date":264,"score":184,"percentile":265},"2026-05-12",0.013,{"date":267,"score":184,"percentile":268},"2026-05-13",0.01306,{"date":270,"score":184,"percentile":271},"2026-05-14",0.01312,{"date":273,"score":184,"percentile":254},"2026-05-15",{"date":275,"score":184,"percentile":268},"2026-05-16",{"date":277,"score":184,"percentile":278},"2026-05-17",0.01303,{"date":280,"score":184,"percentile":281},"2026-05-18",0.01296,{"date":283,"score":284,"percentile":285},"2026-05-19",0.00012,0.01834,{"date":287,"score":284,"percentile":288},"2026-05-20",0.0183,{"date":290,"score":284,"percentile":291},"2026-05-21",0.01819,{"date":293,"score":284,"percentile":294},"2026-05-22",0.01945,{"date":296,"score":284,"percentile":297},"2026-05-23",0.01941,{"date":299,"score":284,"percentile":300},"2026-05-24",0.0194,{"date":302,"score":284,"percentile":303},"2026-05-25",0.01928,{"date":305,"score":284,"percentile":306},"2026-05-26",0.01921,{"date":308,"score":284,"percentile":309},"2026-05-27",0.01936,{"date":311,"score":284,"percentile":312},"2026-05-28",0.0193,{"date":314,"score":284,"percentile":315},"2026-05-29",0.01939,{"date":317,"score":284,"percentile":318},"2026-05-30",0.01962,{"date":320,"score":284,"percentile":321},"2026-05-31",0.01955,{"date":323,"score":284,"percentile":297},"2026-06-01",{"date":325,"score":284,"percentile":326},"2026-06-02",0.01926,{"date":328,"score":284,"percentile":329},"2026-06-03",0.01912,{"date":331,"score":284,"percentile":332},"2026-06-04",0.01909,{"date":334,"score":284,"percentile":335},"2026-06-05",0.01923,{"date":337,"score":284,"percentile":338},"2026-06-06",0.01929,{"date":340,"score":284,"percentile":341},"2026-06-07",0.0192,{"date":343,"score":284,"percentile":344},"2026-06-08",0.01906,{"date":346,"score":284,"percentile":347},"2026-06-09",0.019,{"date":349,"score":284,"percentile":350},"2026-06-10",0.01899,[352,357,359],{"source":56,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":353,"cvss_v4_0":9},{"baseScore":54,"baseSeverity":354,"vectorString":57,"impactScore":355,"exploitabilityScore":356},"MEDIUM",4.2,5.4,{"source":62,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":358,"cvss_v4_0":9},{"baseScore":54,"baseSeverity":354,"vectorString":57,"impactScore":355,"exploitabilityScore":356},{"source":63,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":360,"cvss_v4_0":9},{"baseScore":54,"baseSeverity":9,"vectorString":57,"impactScore":355,"exploitabilityScore":356},[362,378,387],{"ecosystem":9,"name":363,"vendor":364,"product":363,"cpe_part":365,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":366},"undici","nodejs","a",[367,373],{"version":368,"is_range":369,"range_type":370,"version_start":9,"version_start_type":9,"version_end":371,"version_end_type":372,"fixed_in":9},"lt6.24.0",true,"cpe","6.24.0","excluding",{"version":374,"is_range":369,"range_type":370,"version_start":375,"version_start_type":376,"version_end":377,"version_end_type":372,"fixed_in":9},"gte7.0.0_lt7.24.0","7.0.0","including","7.24.0",{"ecosystem":379,"name":363,"vendor":379,"product":363,"cpe_part":9,"purl_type":380,"purl_namespace":9,"purl_name":363,"source":9,"versions":381},"Npm","npm",[382,385],{"version":383,"is_range":369,"range_type":384,"version_start":9,"version_start_type":9,"version_end":371,"version_end_type":372,"fixed_in":9},"lt6_24_0","semver",{"version":386,"is_range":369,"range_type":384,"version_start":375,"version_start_type":376,"version_end":377,"version_end_type":372,"fixed_in":9},"gte7_0_0_lt7_24_0",{"ecosystem":9,"name":363,"vendor":363,"product":363,"cpe_part":365,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":388},[389],{"version":390,"is_range":369,"range_type":56,"version_start":9,"version_start_type":9,"version_end":391,"version_end_type":372,"fixed_in":9},"\u003C 6.24.0; 7.0.0 \u003C 7.24.0","6.24.0; 7.0.0 \u003C 7.24.0"]