Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade npm | Apr 21, 2023 | Feb 16, 2023 |
| Alpine Linux | — | Upgrade nodejs | Aug 22, 2024 | Feb 16, 2023 |
| Centos_linux | — | Upgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejs | Apr 10, 2023 | Feb 16, 2023 |
| Debian | — | Upgrade node-undici | Jul 30, 2024 | Feb 16, 2023 |
| Oracle_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejs-docs | Apr 5, 2023 | Feb 16, 2023 |
| Redhat_linux | — | Upgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-libs-debuginfoUpgrade nodejsUpgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-libsUpgrade nodejs-devel | Apr 10, 2023 | Feb 16, 2023 |
| Rocky_linux | — | Upgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-libsUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs | Mar 5, 2024 | Feb 16, 2023 |
| Suse | — | Upgrade nodejs18Upgrade nodejs16-docsUpgrade corepack18Upgrade npm16Upgrade nodejs18-develUpgrade npm18Upgrade nodejs18-docsUpgrade nodejs16-develUpgrade corepack16Upgrade nodejs16 | Mar 6, 2023 | Feb 16, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub