CVEvulnerability

CVE-2023-23936

5.4 MEDIUM Published 2023-02-16 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-02-16
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS 3.1 ([email protected])
5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-74, CWE-93

Description

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.

Affected configurations

• nodejs node.js (>= 16.0.0 < 16.19.1) • nodejs node.js (>= 18.0.0 < 18.14.1) • nodejs node.js (>= 19.0.0 < 19.6.1) • nodejs undici (>= 2.0.0 < 5.19.1)

Related

Weakness · CWE (2)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-93 Improper Neutralization of CRLF Sequences weakness

References