CVE-2023-24807
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-24807
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-24807.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2023-24807
- Aliases
- Downstream
- Related
- Published
- 2023-02-16T18:15:12Z
- Modified
- 2025-09-30T07:31:07.180930Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the
Headers.set()andHeaders.append()methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in theheaderValueNormalize()utility function. This vulnerability was patched in v5.19.1. No known workarounds are available. - References
-
- https://github.com/nodejs/undici/releases/tag/v5.19.1
- https://github.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w
- https://hackerone.com/bugs?report_id=1784449
- https://security.netapp.com/advisory/ntap-20230324-0010/
- https://github.com/nodejs/undici/commit/f2324e549943f0b0937b09fb1c0c16cc7c93abdf
Affected packages
Git / github.com/nodejs/undici
Affected ranges
- Type
- GIT
- Repo
- https://github.com/nodejs/undici
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
Affected versions
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v1.1.0
v1.2.0
v1.2.1
v1.2.2
v1.2.5
v1.2.6
v1.3.0
v1.3.1
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.1.0
v3.*
v3.0.0
v3.1.0
v3.2.0
v3.3.0
v3.3.1
v4.*
v4.0.0
v4.0.0-alpha.0
v4.0.0-alpha.1
v4.0.0-alpha.2
v4.0.0-alpha.4
v4.0.0-alpha.5
v4.0.0-rc.1
v4.0.0-rc.2
v4.0.0-rc.3
v4.0.0-rc.4
v4.0.0-rc.5
v4.0.0-rc.7
v4.0.0-rc.8
v4.1.0
v4.1.1
v4.10.0
v4.10.1
v4.10.2
v4.10.3
v4.10.4
v4.11.0
v4.11.1
v4.11.2
v4.11.3
v4.12.0
v4.12.2
v4.13.0
v4.14.0
v4.14.1
v4.15.0
v4.15.1
v4.16.0
v4.2.1
v4.2.2
v4.3.0
v4.3.1
v4.4.1
v4.4.2
v4.4.3
v4.4.4
v4.4.5
v4.4.6
v4.4.7
v4.5.0
v4.5.1
v4.6.0
v4.7.0
v4.7.1
v4.7.2
v4.7.3
v4.8.0
v4.8.1
v4.8.2
v4.9.0
v4.9.1
v4.9.2
v4.9.3
v4.9.4
v4.9.5
v5.*
v5.0.0
v5.1.0
v5.1.1
v5.10.0
v5.11.0
v5.12.0
v5.13.0
v5.14.0
v5.15.0
v5.15.1
v5.15.2
v5.16.0
v5.17.0
v5.17.1
v5.18.0
v5.19.0
v5.2.0
v5.3.0
v5.4.0
v5.5.0
v5.5.1
v5.6.0
v5.6.1
v5.7.0
v5.8.0
v5.8.1
v5.8.2
v5.9.1