Vulnerabilities > CVE-2023-24807 - Unspecified vulnerability in Nodejs Undici

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

nodejs

NVD

Published: 2023-02-16

Updated: 2023-02-24

Summary

Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.

Vulnerable Configurations

Part	Description	Count
Application	Nodejs Nodejs Undici - Nodejs Undici 1.0.0 Nodejs Undici 1.0.1 Nodejs Undici 1.0.2 Nodejs Undici 1.0.3 Nodejs Undici 1.1.0 Nodejs Undici 1.2.0 Nodejs Undici 1.2.1 Nodejs Undici 1.2.2 Nodejs Undici 1.2.4 Nodejs Undici 1.2.5 Nodejs Undici 1.2.6 Nodejs Undici 1.3.0 Nodejs Undici 1.3.1 Nodejs Undici 2.0.0 Nodejs Undici 2.0.1 Nodejs Undici 2.0.2 Nodejs Undici 2.0.3 Nodejs Undici 2.0.4 Nodejs Undici 2.0.5 Nodejs Undici 2.0.6 Nodejs Undici 2.0.7 Nodejs Undici 2.1.0 Nodejs Undici 2.1.1 Nodejs Undici 2.2.0 Nodejs Undici 2.2.1 Nodejs Undici 3.0.0 Nodejs Undici 3.1.0 Nodejs Undici 3.2.0 Nodejs Undici 3.3.0 Nodejs Undici 3.3.1 Nodejs Undici 3.3.2 Nodejs Undici 3.3.3 Nodejs Undici 3.3.4 Nodejs Undici 3.3.5 Nodejs Undici 3.3.6 Nodejs Undici 4.0.0 Nodejs Undici 4.1.0 Nodejs Undici 4.1.1 Nodejs Undici 4.2.0 Nodejs Undici 4.2.1 Nodejs Undici 4.2.2 Nodejs Undici 4.3.0 Nodejs Undici 4.3.1 Nodejs Undici 4.4.0 Nodejs Undici 4.4.1 Nodejs Undici 4.4.2 Nodejs Undici 4.4.3 Nodejs Undici 4.4.4 Nodejs Undici 4.4.5 Nodejs Undici 4.4.6 Nodejs Undici 4.4.7 Nodejs Undici 4.5.0 Nodejs Undici 4.5.1 Nodejs Undici 4.6.0 Nodejs Undici 4.7.0 Nodejs Undici 4.7.1 Nodejs Undici 4.7.2 Nodejs Undici 4.7.3 Nodejs Undici 4.8.0 Nodejs Undici 4.8.1 Nodejs Undici 4.8.2 Nodejs Undici 4.9.0 Nodejs Undici 4.9.1 Nodejs Undici 4.9.2 Nodejs Undici 4.9.3 Nodejs Undici 4.9.4 Nodejs Undici 4.9.5 Nodejs Undici 4.10.0 Nodejs Undici 4.10.1 Nodejs Undici 4.10.2 Nodejs Undici 4.10.3 Nodejs Undici 4.10.4 Nodejs Undici 4.11.0 Nodejs Undici 4.11.1 Nodejs Undici 4.11.2 Nodejs Undici 4.11.3 Nodejs Undici 4.12.0 Nodejs Undici 4.12.1 Nodejs Undici 4.12.2 Nodejs Undici 4.13.0 Nodejs Undici 4.14.0 Nodejs Undici 4.14.1 Nodejs Undici 4.15.0 Nodejs Undici 4.15.1 Nodejs Undici 4.16.0 Nodejs Undici 5.0.0 Nodejs Undici 5.1.0 Nodejs Undici 5.1.1 Nodejs Undici 5.2.0 Nodejs Undici 5.3.0 Nodejs Undici 5.4.0 Nodejs Undici 5.5.0 Nodejs Undici 5.5.1 Nodejs Undici 5.6.0 Nodejs Undici 5.6.1 Nodejs Undici 5.7.0 Nodejs Undici 5.7.1 Nodejs Undici 5.8.0 Nodejs Undici 5.8.1 Nodejs Undici 5.8.2 Nodejs Undici 5.9.1 Nodejs Undici 5.10.0 Nodejs Undici 5.11.0 Nodejs Undici 5.12.0 Nodejs Undici 5.13.0 Nodejs Undici 5.14.0 Nodejs Undici 5.15.0 Nodejs Undici 5.15.1 Nodejs Undici 5.15.2 Nodejs Undici 5.16.0 Nodejs Undici 5.17.0 Nodejs Undici 5.17.1 Nodejs Undici 5.18.0 Nodejs Undici 5.19.0	129

Summary

Vulnerable Configurations

References