Loading vulnerability details...
ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to:
// lib/dispatcher/client-h1.js:1121
if (upgrade) {
header += connection: upgrade\r\nupgrade: ${upgrade}\r\n
}
ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to:
// lib/dispatcher/client-h1.js:1121
if (upgrade) {
header += connection: upgrade\r\nupgrade: ${upgrade}\r\n
} This vulnerability involves weaknesses in
This medium-severity vulnerability could be exploited under certain conditions to compromise security controls or access sensitive information. Should be addressed in a timely manner.
Probability of exploitation in the next 30 days · more likely than 19.2% of all CVEs.
Apply security patches to version 6.24.0, 7.24.0 immediately
Isolate affected systems from untrusted networks until patching is complete
Implement enhanced monitoring for exploitation attempts and unusual behavior