Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-packaging-bundlerUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-devel | Apr 21, 2023 | Feb 16, 2023 |
| Alpine Linux | — | Upgrade nodejs | Aug 22, 2024 | Feb 16, 2023 |
| Centos_linux | — | Upgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade npm | Apr 10, 2023 | Feb 16, 2023 |
| Debian | — | Upgrade node-undici | Jul 30, 2024 | Feb 16, 2023 |
| Oracle_linux | — | Upgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejsUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-packaging-bundler | Apr 5, 2023 | Feb 16, 2023 |
| Redhat_linux | — | Upgrade nodejs-libsUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-debuginfo | Apr 10, 2023 | Feb 16, 2023 |
| Rocky_linux | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-debugsource | Mar 5, 2024 | Feb 16, 2023 |
| Suse | — | Upgrade npm18Upgrade nodejs18-develUpgrade nodejs16Upgrade corepack16Upgrade nodejs16-docsUpgrade corepack18Upgrade nodejs16-develUpgrade nodejs18-docsUpgrade nodejs18Upgrade npm16 | Mar 6, 2023 | Feb 16, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Feb 16, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub