Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade npmUpgrade nodejs-nodemon | Apr 21, 2023 | Feb 16, 2023 |
| Alpine Linux | — | Upgrade nodejs | Aug 22, 2024 | Feb 16, 2023 |
| Centos_linux | — | Upgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejsUpgrade nodejs-libs | Apr 10, 2023 | Feb 16, 2023 |
| Debian | — | Upgrade node-undici | Jul 30, 2024 | Feb 16, 2023 |
| Oracle_linux | — | Upgrade nodejs-libsUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade npmUpgrade nodejs-develUpgrade nodejs-packaging-bundler | Apr 5, 2023 | Feb 16, 2023 |
| Redhat_linux | — | Upgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-docs | Apr 10, 2023 | Feb 16, 2023 |
| Rocky_linux | — | Upgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-libs-debuginfoUpgrade nodejsUpgrade nodejs-develUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-debuginfo | Mar 5, 2024 | Feb 16, 2023 |
| Suse | — | Upgrade npm18Upgrade nodejs18-docsUpgrade corepack16Upgrade nodejs16-develUpgrade nodejs16Upgrade nodejs16-docsUpgrade nodejs18Upgrade corepack18Upgrade npm16Upgrade nodejs18-devel | Mar 6, 2023 | Feb 16, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub