The vulnerability allows an attacker to inject CRLF sequences into the upgrade option of undici's client.request(), permitting arbitrary HTTP header injection and premature request termination. This can result in data smuggling into services such as Redis, Memcached, or Elasticsearch, potentially exposing sensitive information or enabling further exploitation. The weakness corresponds to CWE‑93 (CRLF Injection).

The affected product is undici, the HTTP client library used within Node.js environments. No specific version information is provided in the advisory, so any deployment that uses undici's upgrade option and accepts user-controlled input may be affected.

The CVSS score of 4.6 rates the vulnerability as moderate, and the EPSS score indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is external; an attacker can craft a request with a malicious upgrade field that contains CRLF sequences to trigger header injection and smuggling. The impact applies when the application forwards such requests to non-HTTP services, and while the overall risk is moderate, the potential to expose data to services like Redis or Elasticsearch is significant.