CVE Vulnerability

CVE-2023-24807

Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/nodejs/undici/releases/tag/v5.19.1 Release Notes
https://github.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w Vendor Advisory
https://hackerone.com/bugs?report_id=1784449 Permissions Required Third Party Advisory
https://github.com/nodejs/undici/commit/f2324e549943f0b0937b09fb1c0c16cc7c93abdf Patch
Configurations

Configuration 1

cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*
Information

Published : 2023-02-16 06:15

Updated : 2023-02-24 06:38

NVD link : CVE-2023-24807

Mitre link : CVE-2023-24807

Products Affected
No products.
CWE
No CWE.