PT-2023-9604 · Npm+6 · Undici+6

Timon8 + 1 · Published 2023-01-03 · Updated 2026-05-18 · CVE-2023-23936

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Undici versions 2.0.0 through 5.19.0

Description The issue is related to the undici library not protecting the host HTTP header from CRLF injection vulnerabilities. This could allow a remote attacker to inject arbitrary HTTP headers. The undici library is an HTTP/1.1 client for Node.js. As a workaround, sanitizing the headers.host string before passing it to undici can help mitigate the issue.

Recommendations For versions 2.0.0 through 5.19.0, update to version 5.19.1 to resolve the issue. As a temporary workaround, consider sanitizing the headers.host string before passing it to undici.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-113

CWE-93

CWE-74

Related Identifiers

ALSA-2023:1582

ALSA-2023:1583

ALSA-2023:2654

ALSA-2023:2655

ALSA-2023_1582

ALSA-2023_1583

ALSA-2023_1743

ALSA-2023_2654

ALSA-2023_2655

ALT-PU-2023-1431

ALT-PU-2023-1494

ALT-PU-2023-1496

AZL-13604

BDU:2024-08734

BIT-NODE-2023-23936

BIT-NODE-MIN-2023-23936

CESA-2023_1582

CESA-2023_1583

CLEANSTART-2026-BD71263

CLEANSTART-2026-IS74202

CLEANSTART-2026-JR35772

CLEANSTART-2026-JY06700

CLEANSTART-2026-KN34553

CLEANSTART-2026-KZ45320

CLEANSTART-2026-LJ44720

CLEANSTART-2026-LN12820

CLEANSTART-2026-TX00223

CLEANSTART-2026-WI75198

CVE-2023-23936

GHSA-5R9G-QH6M-JXFF

RHSA-2023:1582

RHSA-2023:1583

RHSA-2023:2654

RHSA-2023:2655

RHSA-2023:5533

RHSA-2023_1582

RHSA-2023_1583

RHSA-2023_2654

RHSA-2023_2655

RLSA-2023:1582

RLSA-2023:1583

RLSA-2023:2655

SUSE-SU-2023:0608-1

SUSE-SU-2023:0609-1

SUSE-SU-2023:0673-1

SUSE-SU-2023:0715-1

SUSE-SU-2023:0738-1

Affected Products

Alt Linux

Almalinux

Centos

Red Hat

Rocky Linux

Suse

Undici

References · 236

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23936.json · Exploit
• 🔥 https://hackerone.com/reports/1820955 · Exploit
• https://github.com/nodejs/undici/commit/a2eff05401358f6595138df963837c24348f2034 · Patch
• https://github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxff · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22931 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-24807 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-9514 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-37372 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-9516 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-23918 · Security Note
• https://osv.dev/vulnerability/BIT-node-min-2023-23936 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:0609-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000168 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2023:0673-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:0738-1 · Vendor Advisory