diff --git a/NEWS b/NEWS
index 2e88507fc..543e7103f 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,8 @@ ver 0.23.5 (not yet released)
 * protocol
   - support relative offsets for "searchadd"
   - fix "searchaddpl" bug (bogus error "Bad position")
+* database
+  - upnp: fix crash bug
 * migrate to PCRE2
 * GCC 12 build fixes
 
diff --git a/src/lib/upnp/Discovery.hxx b/src/lib/upnp/Discovery.hxx
index 979a6fde6..3391148dd 100644
--- a/src/lib/upnp/Discovery.hxx
+++ b/src/lib/upnp/Discovery.hxx
@@ -27,7 +27,7 @@
 #include "lib/curl/Handler.hxx"
 #include "lib/curl/Request.hxx"
 #include "thread/Mutex.hxx"
-#include "event/DeferEvent.hxx"
+#include "event/InjectEvent.hxx"
 #include "util/IntrusiveList.hxx"
 
 #include <list>
@@ -81,7 +81,7 @@ class UPnPDeviceDirectory final : UpnpCallback {
 	class Downloader final
 		: public IntrusiveListHook, CurlResponseHandler
 	{
-		DeferEvent defer_start_event;
+		InjectEvent defer_start_event;
 
 		UPnPDeviceDirectory &parent;