PT-2023-19790 · Node.Js+6 · Undici+6
Carter Snook
·
Published
2023-02-16
·
Updated
2026-05-18
·
CVE-2023-24807
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Undici versions prior to 5.19.1
Description
Undici is an HTTP/1.1 client for Node.js. The
Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function.Recommendations
For versions prior to 5.19.1, update to version 5.19.1 or later to resolve the issue. As a temporary workaround, consider restricting the input to the
Headers.set() and Headers.append() methods to trusted values only, until a patch is applied. Additionally, be cautious when using the headerValueNormalize() utility function with untrusted input.Exploit
Fix
DoS
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Red Hat
Rocky Linux
Suse
Undici