p PatchFirst

CVE-2023-24807

CVE-2023-24807 · Undici vulnerable to Regular Expression Denial of Service in Headers

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.

CVSS 7.5 · High · EPSS 1.3% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • undici

    Versions
    • < 5.19.1: Affected

    No fix published

  • node-undici Debian:12

    Versions
    • 5.15.0+dfsg1+~cs20.10.9.3-1
    Affected ranges
    • ECOSYSTEM: < 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1

    Update to 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1

  • node-undici Debian:13

    Affected ranges
    • ECOSYSTEM: < 5.19.1+dfsg1+~cs20.10.9.5-1

    Update to 5.19.1+dfsg1+~cs20.10.9.5-1

  • node-undici Debian:14

    Affected ranges
    • ECOSYSTEM: < 5.19.1+dfsg1+~cs20.10.9.5-1

    Update to 5.19.1+dfsg1+~cs20.10.9.5-1

  • undici npm

    Affected ranges
    • SEMVER: < 5.19.1

    Update to 5.19.1

Original sources

Check your server →