Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-libsUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejsUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-devel | Apr 21, 2023 | Feb 16, 2023 |
| Alpine Linux | — | Upgrade nodejs | Aug 22, 2024 | Feb 16, 2023 |
| Centos_linux | — | Upgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejs-nodemon | Apr 10, 2023 | Feb 16, 2023 |
| Debian | — | Upgrade node-undici | Jul 30, 2024 | Feb 16, 2023 |
| Oracle_linux | — | Upgrade nodejs-full-i18nUpgrade nodejsUpgrade npmUpgrade nodejs-libsUpgrade nodejs-packaging-bundlerUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-docs | Apr 5, 2023 | Feb 16, 2023 |
| Redhat_linux | — | Upgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-libs | Apr 10, 2023 | Feb 16, 2023 |
| Rocky_linux | — | Upgrade nodejsUpgrade nodejs-libsUpgrade nodejs-debugsourceUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-libs-debuginfo | Mar 5, 2024 | Feb 16, 2023 |
| Suse | — | Upgrade nodejs18Upgrade corepack18Upgrade nodejs16Upgrade nodejs16-develUpgrade nodejs16-docsUpgrade nodejs18-docsUpgrade corepack16Upgrade npm16Upgrade nodejs18-develUpgrade npm18 | Mar 6, 2023 | Feb 16, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Feb 16, 2023 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub