Fix CRLF injection in response headers

crlf-header-injection

Raw URL bytes reach your response headers without CRLF stripping, letting an attacker split the response and inject their own headers or body.

Why this matters

Your server passes raw URL bytes into HTTP response headers without sanitizing CRLF characters. An attacker can inject arbitrary headers, enabling response splitting, session fixation via Set-Cookie injection, and XSS via injected Content-Type headers.

Your stack

CDN and edge

Cloudflare

Web servers

Nginx Apache

Frameworks

Express

Cloudflare

1 Cloudflare strips CRLF sequences from URLs by default. If you see this, your origin server is likely exposed directly
2 Enable Cloudflare WAF managed rules or ensure all traffic routes through Cloudflare

Nginx

1 Modern Nginx versions (1.21.1+) reject CRLF in URIs by default. Upgrade if using an older version
2 If behind a reverse proxy, ensure the upstream doesn't pass raw URI bytes

nginx

# Nginx 1.21.1+ blocks CRLF by default
# For older versions, add this to strip encoded CRLFs:
if ($request_uri ~* "%0[dD]%0[aA]") {
    return 400;
}

Apache

1 Use mod_security or mod_rewrite to block requests containing CRLF sequences

apache

# Block CRLF in URLs
RewriteEngine On
RewriteCond %{THE_REQUEST} (%0d|%0a|%0D|%0A) [NC]
RewriteRule .* - [F]

Express

1 URL-encode all user input before including it in response headers
2 Use the helmet middleware for additional HTTP header security

javascript

import helmet from 'helmet';
app.use(helmet());

// Never pass raw URL components into headers
// BAD: res.setHeader('Location', req.query.redirect);
// GOOD:
res.setHeader('Location', encodeURI(req.query.redirect));

Does your app still have this?

Scan your domain