CVE-2023-23936
CRLF Injection in Nodejs ‘undici’ via host
Summary
CRLF Injection in Nodejs ‘undici’ via host
Original description
The description as published by the source.
Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect host HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the headers.host string before passing to undici.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
npm
undici
[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"5.19.1"}]}]
Bitnami
node-min
[{"type":"SEMVER","events":[{"introduced":"16.0.0"},{"fixed":"16.19.1"},{"introduced":"18.0.0"},{"fixed":"18.14.1"},{"introduced":"19.0.0"},{"fixed":"19.6.1"}]}]
Bitnami
node
[{"type":"SEMVER","events":[{"introduced":"16.0.0"},{"fixed":"16.19.1"},{"introduced":"18.0.0"},{"fixed":"18.14.1"},{"introduced":"19.0.0"},{"fixed":"19.6.1"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2023-23936 nodejs Fixed in: 16.19.1-r0
- Debian DEBIAN-CVE-2023-23936 node-undici Fixed in: 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1
References
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- patch github.com
- web hackerone.com
- web github.com