Undici vulnerable to Regular Expression Denial of Service in Headers
Summary
Undici vulnerable to Regular Expression Denial of Service in Headers
Original description
The description as published by the source.
Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2023-24807 nodejs Fixed in: 16.19.1-r0
- Debian DEBIAN-CVE-2023-24807 node-undici Fixed in: 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- patch github.com
- web github.com
- web hackerone.com