DEBIAN-CVE-2023-23936

Source
https://security-tracker.debian.org/tracker/CVE-2023-23936
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-23936.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2023-23936
Upstream
Published
2023-02-16T18:15:10Z
Modified
2025-09-30T05:18:43.864492Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect host HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the headers.host string before passing to undici.

References

Affected packages

Debian:12 / node-undici

Package

Name
node-undici
Purl
pkg:deb/debian/node-undici?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1

Affected versions

5.*

5.15.0+dfsg1+~cs20.10.9.3-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / node-undici

Package

Name
node-undici
Purl
pkg:deb/debian/node-undici?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.19.1+dfsg1+~cs20.10.9.5-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:14 / node-undici

Package

Name
node-undici
Purl
pkg:deb/debian/node-undici?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.19.1+dfsg1+~cs20.10.9.5-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}