Security vulnerabilities and automated fixes for crlf injection issues
3 posts found
A high-severity CRLF injection vulnerability (CVE-2026-55603) was discovered in http-proxy-middleware versions prior to 3.0.7, allowing attackers to inject carriage return and line feed characters into proxied requests, potentially compromising data integrity. The fix upgrades the dependency from version 3.0.5 to 3.0.7, which adds proper sanitization of CR/LF characters in user-controlled input before forwarding requests to backend services.
A critical vulnerability in the file upload handler allowed attackers to inject CRLF sequences into HTTP response headers through crafted filenames. The fix sanitizes user-supplied filenames before using them in Content-Disposition headers, preventing header injection attacks that could lead to cache poisoning, session fixation, or XSS.
A high-severity Server-Sent Events (SSE) injection vulnerability (CVE-2026-33128) was discovered in the h3 HTTP framework, where unsanitized newline characters in event stream fields could allow attackers to inject arbitrary SSE messages. The fix upgrades h3 from version 1.15.5 to 1.15.6 in the frontend's dependency tree, ensuring that newline characters are properly sanitized before being written to event streams.