Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.
References
| Link | Resource |
|---|---|
| https://github.com/nodejs/undici/commit/f2324e549943f0b0937b09fb1c0c16cc7c93abdf | Patch |
| https://github.com/nodejs/undici/releases/tag/v5.19.1 | Release Notes |
| https://github.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w | Vendor Advisory |
| https://hackerone.com/bugs?report_id=1784449 | Permissions Required Third Party Advisory |
| https://github.com/nodejs/undici/commit/f2324e549943f0b0937b09fb1c0c16cc7c93abdf | Patch |
| https://github.com/nodejs/undici/releases/tag/v5.19.1 | Release Notes |
| https://github.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w | Vendor Advisory |
| https://hackerone.com/bugs?report_id=1784449 | Permissions Required Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20230324-0010/ |
Configurations
History
21 Nov 2024, 07:48
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| References | () https://github.com/nodejs/undici/commit/f2324e549943f0b0937b09fb1c0c16cc7c93abdf - Patch | |
| References | () https://github.com/nodejs/undici/releases/tag/v5.19.1 - Release Notes | |
| References | () https://github.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w - Vendor Advisory | |
| References | () https://hackerone.com/bugs?report_id=1784449 - Permissions Required, Third Party Advisory |
Information
Published : 2023-02-16 18:15
Updated : 2024-11-21 07:48
NVD link : CVE-2023-24807
Mitre link : CVE-2023-24807
CVE.ORG link : CVE-2023-24807
JSON object : View
Products Affected
nodejs
- undici