# CVE-2022-35948: CRLF Injection in Nodejs ‘undici’ via Content-Type

undici's request() failed to sanitize CRLF in the content-type header, letting attacker input inject a second HTTP request (request smuggling).

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: x_h1
- Disclosed: 2022-09-23
- CVE: CVE-2022-35948
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1664019
- Library page: https://bugbountylibrary.com/r/h1%3A1664019
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:nodejs vuln:crlf-injection vuln:request-smuggling

**Target:** Node.js undici HTTP client request headers
**Root cause:** The content-type header value was not validated for CR/LF characters before being written into the outgoing request, allowing header/request splitting.
**Steps:**
1. Install undici <=5.8.0.
2. Call `request('http://localhost:3000', {method:'GET', headers:{'content-type':'application/json\r\n\r\nGET /foo2 HTTP/1.1'}})`
3. Observe two requests hit the server: `/` and `/foo2`.
**Exploitation:** Attacker-controlled content-type input containing CRLFCRLF terminates headers and injects a smuggled second request line, causing the client to issue an unintended request to the same host.
**Insight:** HTTP client libraries often sanitize common headers but miss content-type; test every header field individually with CRLF payloads to find request-splitting gaps.