vulnerability
CentOS Linux: CVE-2023-24807: Moderate: nodejs:16 security, bug fix, and enhancement update (Multiple Advisories)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 8 | (AV:N/AC:L/Au:N/C:N/I:N/A:C) | 2023-02-16 | 2023-04-10 | 2025-01-28 |
Severity
8
CVSS
(AV:N/AC:L/Au:N/C:N/I:N/A:C)
Published
2023-02-16
Added
2023-04-10
Modified
2025-01-28
Description
Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.
Solution(s)
centos-upgrade-nodejscentos-upgrade-nodejs-debuginfocentos-upgrade-nodejs-debugsourcecentos-upgrade-nodejs-develcentos-upgrade-nodejs-docscentos-upgrade-nodejs-full-i18ncentos-upgrade-nodejs-libscentos-upgrade-nodejs-libs-debuginfocentos-upgrade-nodejs-nodemoncentos-upgrade-nodejs-packagingcentos-upgrade-nodejs-packaging-bundlercentos-upgrade-npm
References
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.