Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-develUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-nodemon | Apr 21, 2023 | Feb 16, 2023 |
| Alpine Linux | — | Upgrade nodejs | Aug 22, 2024 | Feb 16, 2023 |
| Centos_linux | — | Upgrade nodejs-docsUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-packagingUpgrade nodejs-debuginfo | Apr 10, 2023 | Feb 16, 2023 |
| Debian | — | Upgrade node-undici | Jul 30, 2024 | Feb 16, 2023 |
| Oracle_linux | — | Upgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-nodemon | Apr 5, 2023 | Feb 16, 2023 |
| Redhat_linux | — | Upgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade nodejs-libsUpgrade nodejs-nodemonUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-debuginfo | Apr 10, 2023 | Feb 16, 2023 |
| Rocky_linux | — | Upgrade nodejs-libsUpgrade nodejs-libs-debuginfoUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-debugsource | Mar 5, 2024 | Feb 16, 2023 |
| Suse | — | Upgrade nodejs16Upgrade corepack16Upgrade npm18Upgrade nodejs18-docsUpgrade nodejs16-develUpgrade nodejs18Upgrade npm16Upgrade nodejs16-docsUpgrade nodejs18-develUpgrade corepack18 | Mar 6, 2023 | Feb 16, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub