fix: validate coerced header values for CRLF - #5579
Merged
mcollina merged 1 commit intoJul 22, 2026
Merged
Conversation
Copy link
Copy Markdown
Member
Sorry, something went wrong.
Functions bypassed the object guard in processHeader() and were coerced via template literals without isValidHeaderValue(), allowing CRLF injection when toString/Symbol.toPrimitive returned embedded newlines. Validate after coercion on both scalar and array paths. Signed-off-by: Matteo Collina <hello@matteocollina.com>
Copy link
Copy Markdown
Codecov Report✅ All modified and coverable lines are covered by tests. @@ Coverage Diff @@
## main #5579 +/- ##
==========================================
- Coverage 93.47% 93.47% -0.01%
==========================================
Files 110 110
Lines 37564 37575 +11
==========================================
+ Hits 35114 35122 +8
- Misses 2450 2453 +3 ☔ View full report in Codecov by Harness.
|
Sorry, something went wrong.
metcoder95
approved these changes
Jul 21, 2026
jasnell
approved these changes
Jul 22, 2026
mcollina
added a commit
that referenced
this pull request
Jul 24, 2026
Functions bypassed the object guard in processHeader() and were coerced via template literals without isValidHeaderValue(), allowing CRLF injection when toString/Symbol.toPrimitive returned embedded newlines. Validate after coercion on both scalar and array paths. Signed-off-by: Matteo Collina <hello@matteocollina.com> (cherry picked from commit 354a151)
mcollina
added a commit
that referenced
this pull request
Jul 24, 2026
Functions bypassed the object guard in processHeader() and were coerced via template literals without isValidHeaderValue(), allowing CRLF injection when toString/Symbol.toPrimitive returned embedded newlines. Validate after coercion on both scalar and array paths. Signed-off-by: Matteo Collina <hello@matteocollina.com> (cherry picked from commit 354a151)
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Reviewers
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
processHeader() rejected objects but not functions (typeof fn === 'function'). Non-string values were coerced with `${val}` and written to the HTTP/1.1 wire without isValidHeaderValue(), so a function with a crafted toString() / Symbol.toPrimitive could inject CRLF sequences into request headers.
This is defense-in-depth / hardening, not a security advisory under our threat model: exploitation requires the application to pass a function as a header value (trusted application input). String CRLF was already rejected.
Changes
Test plan