CRLF injection
Carriage-return and line-feed characters in untrusted input end a line where the application did not expect one, letting an attacker add HTTP headers or split a response (CWE-113) or forge log entries (CWE-117); CWE-93 is the general class. Reject or encode CR and LF in values written to line-based formats.
- Also called
- HTTP response splitting · header injection
- Fix it in your stack
- CRLF injection in logs and response headers fix cards (3 stacks) · CWE-113 page · CWE-117 page · CWE-93 page
- Defined in
- MITRE CWE-93
Covered in
Prevent CRLF header injection, log forging and CSV formula injection
Carriage return and line feed separate HTTP header fields, log records and CSV rows, and a leading = turns a spreadsheet cell into a formula. Let the framework write headers, log structured JSON, and neutralize formula triggers in exports.
Create security logs someone can investigate
Record meaningful decisions with consistent structure, protect the resulting evidence, and prove that important events reach an operational owner.
Defend JWTs against forgery, confusion and replay
Verify a JWT as an issuer-, type- and audience-bound assertion with an algorithm allowlist and trusted keys, closing the alg "none", key-confusion, header-injection, weak-secret and replay attacks.
Practice: JWT verification lab: Verify a JWT before trusting it