Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-nodemon | Apr 21, 2023 | Feb 16, 2023 |
| Alpine Linux | — | Upgrade nodejs | Aug 22, 2024 | Feb 16, 2023 |
| Centos_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejs-debugsourceUpgrade npmUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-nodemon | Apr 10, 2023 | Feb 16, 2023 |
| Debian | — | Upgrade node-undici | Jul 30, 2024 | Feb 16, 2023 |
| Oracle_linux | — | Upgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-devel | Apr 5, 2023 | Feb 16, 2023 |
| Redhat_linux | — | Upgrade nodejs-develUpgrade nodejs-libsUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-nodemon | Apr 10, 2023 | Feb 16, 2023 |
| Rocky_linux | — | Upgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade npm | Mar 5, 2024 | Feb 16, 2023 |
| Suse | — | Upgrade corepack16Upgrade nodejs16Upgrade nodejs16-develUpgrade nodejs18-docsUpgrade npm18Upgrade nodejs16-docsUpgrade corepack18Upgrade nodejs18-develUpgrade nodejs18Upgrade npm16 | Mar 6, 2023 | Feb 16, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub