PT-2023-19790 · Node.Js+6 · Undici+6
Carter Snook
·
Publicado
2023-02-16
·
Atualizado
2026-05-18
·
CVE-2023-24807
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Undici versions prior to 5.19.1
Description
Undici is an HTTP/1.1 client for Node.js. The
Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function.Recommendations
For versions prior to 5.19.1, update to version 5.19.1 or later to resolve the issue. As a temporary workaround, consider restricting the input to the
Headers.set() and Headers.append() methods to trusted values only, until a patch is applied. Additionally, be cautious when using the headerValueNormalize() utility function with untrusted input.Exploit
Correção
DoS
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Centos
Red Hat
Rocky Linux
Suse
Undici