Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade npm | Apr 21, 2023 | Feb 16, 2023 |
| Alpine Linux | — | Upgrade nodejs | Aug 22, 2024 | Feb 16, 2023 |
| Centos_linux | — | Upgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-libs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs-nodemonUpgrade nodejsUpgrade nodejs-full-i18n | Apr 10, 2023 | Feb 16, 2023 |
| Debian | — | Upgrade node-undici | Jul 30, 2024 | Feb 16, 2023 |
| Oracle_linux | — | Upgrade npmUpgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejsUpgrade nodejs-libs | Apr 5, 2023 | Feb 16, 2023 |
| Redhat_linux | — | Upgrade nodejs-libsUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-libs-debuginfoUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-full-i18n | Apr 10, 2023 | Feb 16, 2023 |
| Rocky_linux | — | Upgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejs-full-i18n | Mar 5, 2024 | Feb 16, 2023 |
| Suse | — | Upgrade nodejs16Upgrade nodejs18-docsUpgrade npm18Upgrade corepack16Upgrade nodejs16-develUpgrade npm16Upgrade nodejs18Upgrade corepack18Upgrade nodejs18-develUpgrade nodejs16-docs | Mar 6, 2023 | Feb 16, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub