GitHub Advisoryadvisory · npm
GHSA-r6ch-mqf9-qc9w Regular Expression Denial of Service in Headers
HIGH
Official page ↗
- Aliases
- CVE-2023-24807
- Ecosystem
- npm
- Packages
- undici
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-1333
- Reviewed
- 2023-02-16
Affected packages
• npm undici: < 5.19.1 → fixed in 5.19.1
Description
Impact
The `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function.
Patches
This vulnerability was patched in v5.19.1.
Workarounds
There is no workaround. Please update to an unaffected version.
References
• https://hackerone.com/bugs?report_id=1784449
Credits
Carter Snook reported this vulnerability.
Related
Alias · CVE (1)
- CVE-2023-24807 Undici is an HTTP/1.1 client for Node.js. vulnerability
Weakness · CWE (1)
- CWE-1333 Inefficient Regular Expression Complexity weakness
References
- https://github.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w web
- https://nvd.nist.gov/vuln/detail/CVE-2023-24807 advisory
- https://github.com/nodejs/undici/commit/f2324e549943f0b0937b09fb1c0c16cc7c93abdf web
- https://github.com/nodejs/undici package
- https://github.com/nodejs/undici/releases/tag/v5.19.1 web
- https://hackerone.com/bugs?report_id=1784449 web