undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate `\r\n` is a workaround for this issue.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade node-undici | Jul 30, 2024 | Jul 19, 2022 |
| Suse | — | Upgrade nodejs16Upgrade npm16Upgrade nodejs16-develUpgrade nodejs16-docsUpgrade corepack16 | Oct 26, 2022 | Jul 19, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub