Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-nodemonUpgrade npmUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-packaging-bundler | Apr 21, 2023 | Feb 16, 2023 |
| Alpine Linux | — | Upgrade nodejs | Aug 22, 2024 | Feb 16, 2023 |
| Centos_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-debugsource | Apr 10, 2023 | Feb 16, 2023 |
| Debian | — | Upgrade node-undici | Jul 30, 2024 | Feb 16, 2023 |
| Oracle_linux | — | Upgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejs-full-i18n | Apr 5, 2023 | Feb 16, 2023 |
| Redhat_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-libs-debuginfoUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-libsUpgrade npmUpgrade nodejs-develUpgrade nodejs-packaging-bundler | Apr 10, 2023 | Feb 16, 2023 |
| Rocky_linux | — | Upgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-libsUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade npm | Mar 5, 2024 | Feb 16, 2023 |
| Suse | — | Upgrade npm18Upgrade nodejs18-docsUpgrade nodejs16-develUpgrade corepack16Upgrade nodejs16Upgrade nodejs16-docsUpgrade nodejs18Upgrade corepack18Upgrade npm16Upgrade nodejs18-devel | Mar 6, 2023 | Feb 16, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub