GitHub Advisoryadvisory · npm

GHSA-5r9g-qh6m-jxff CRLF Injection in Nodejs ‘undici’ via host

MEDIUM Published 2023-02-16 Modified 2023-02-16 Official page ↗
Aliases
CVE-2023-23936
Ecosystem
npm
Packages
undici
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-74, CWE-93
Reviewed
2023-02-16

Affected packages

• npm undici: >= 2.0.0, < 5.19.1 → fixed in 5.19.1

Description

Impact undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. Patches This issue was patched in Undici v5.19.1. Workarounds Sanitize the `headers.host` string before passing to undici. References Reported at https://hackerone.com/reports/1820955. Credits Thank you to Zhipeng Zhang (@timon8) for reporting this vulnerability.

Related

Alias · CVE (1)

  • CVE-2023-23936 Undici is an HTTP/1.1 client for Node.js. vulnerability

Weakness · CWE (2)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-93 Improper Neutralization of CRLF Sequences weakness

References