Vulnerability · Published Feb 16, 2023 · Assigned by GitHub_M
CVE-2023-24807Undici vulnerable to Regular Expression Denial of Service in Headers
High 7.5
In plain English
A high-severity improper input validation in undici from nodejs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.3%top 29.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | nodejs | 1:18.14.2-2.module_el8.7.0+3497+c65299e7 | ALSA-2023:1583 |
| AlmaLinux:8 | nodejs | 1:16.19.1-1.module_el8.7.0+3496+a59a3324 | ALSA-2023:1582 |
| AlmaLinux:9 | nodejs | 1:16.19.1-1.el9_2 | ALSA-2023:2655 |
| AlmaLinux:9 | nodejs | 1:18.14.2-2.module_el9.2.0+29+de583a0b | ALSA-2023:2654 |
| AlmaLinux:8 | nodejs-devel | 1:16.19.1-1.module_el8.7.0+3496+a59a3324 | ALSA-2023:1582 |
| AlmaLinux:8 | nodejs-devel | 1:18.14.2-2.module_el8.7.0+3497+c65299e7 | ALSA-2023:1583 |
| AlmaLinux:9 | nodejs-devel | 1:18.14.2-2.module_el9.2.0+29+de583a0b | ALSA-2023:2654 |
| AlmaLinux:8 | nodejs-docs | 1:18.14.2-2.module_el8.7.0+3497+c65299e7 | ALSA-2023:1583 |
| AlmaLinux:8 | nodejs-docs | 1:16.19.1-1.module_el8.7.0+3496+a59a3324 | ALSA-2023:1582 |
| AlmaLinux:9 | nodejs-docs | 1:18.14.2-2.module_el9.2.0+29+de583a0b | ALSA-2023:2654 |
| AlmaLinux:9 | nodejs-docs | 1:16.19.1-1.el9_2 | ALSA-2023:2655 |
| AlmaLinux:8 | nodejs-full-i18n | 1:16.19.1-1.module_el8.7.0+3496+a59a3324 | ALSA-2023:1582 |
| AlmaLinux:8 | nodejs-full-i18n | 1:18.14.2-2.module_el8.7.0+3497+c65299e7 | ALSA-2023:1583 |
| AlmaLinux:9 | nodejs-full-i18n | 1:18.14.2-2.module_el9.2.0+29+de583a0b | ALSA-2023:2654 |
| AlmaLinux:9 | nodejs-full-i18n | 1:16.19.1-1.el9_2 | ALSA-2023:2655 |
| AlmaLinux:9 | nodejs-libs | 1:16.19.1-1.el9_2 | ALSA-2023:2655 |
| AlmaLinux:8 | nodejs-nodemon | 2.0.20-2.module_el8.7.0+3497+c65299e7 | ALSA-2023:1583 |
| AlmaLinux:8 | nodejs-nodemon | 2.0.20-3.module_el8.7.0+3496+a59a3324 | ALSA-2023:1582 |
| AlmaLinux:9 | nodejs-nodemon | 2.0.20-2.module_el9.2.0+29+de583a0b | ALSA-2023:2654 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-4.module_el8.7.0+3343+ea2b7901 | ALSA-2023:1583 |
| AlmaLinux:8 | nodejs-packaging | 25-1.module_el8.5.0+2605+45d748af | ALSA-2023:1582 |
| AlmaLinux:9 | nodejs-packaging | 2021.06-4.module_el9.1.0+13+d9a595ea | ALSA-2023:2654 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-4.module_el8.7.0+3343+ea2b7901 | ALSA-2023:1583 |
| AlmaLinux:9 | nodejs-packaging-bundler | 2021.06-4.module_el9.1.0+13+d9a595ea | ALSA-2023:2654 |
| AlmaLinux:8 | npm | 1:9.5.0-1.18.14.2.2.module_el8.7.0+3497+c65299e7 | ALSA-2023:1583 |
| AlmaLinux:8 | npm | 1:8.19.3-1.16.19.1.1.module_el8.7.0+3496+a59a3324 | ALSA-2023:1582 |
| AlmaLinux:9 | npm | 1:8.19.3-1.16.19.1.1.el9_2 | ALSA-2023:2655 |
| AlmaLinux:9 | npm | 1:9.5.0-1.18.14.2.2.module_el9.2.0+29+de583a0b | ALSA-2023:2654 |
| Alpine:v3.20 | nodejs | 18.14.1-r0 | ALPINE-CVE-2023-24807 |
| Alpine:v3.21 | nodejs | 18.14.1-r0 | ALPINE-CVE-2023-24807 |
| Alpine:v3.22 | nodejs | 18.14.1-r0 | ALPINE-CVE-2023-24807 |
| Alpine:v3.23 | nodejs | 18.14.1-r0 | ALPINE-CVE-2023-24807 |
| Alpine:v3.24 | nodejs | 18.14.1-r0 | ALPINE-CVE-2023-24807 |
| Debian:12 | node-undici | 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1 | DEBIAN-CVE-2023-24807 |
| Debian:13 | node-undici | 5.19.1+dfsg1+~cs20.10.9.5-1 | DEBIAN-CVE-2023-24807 |
| Debian:14 | node-undici | 5.19.1+dfsg1+~cs20.10.9.5-1 | DEBIAN-CVE-2023-24807 |
| Rocky Linux:8 | nodejs | 1:16.19.1-1.module+el8.7.0+1178+d52dba78 | RLSA-2023:1582 |
| Rocky Linux:8 | nodejs | 1:18.14.2-2.module+el8.7.0+1177+510ae886 | RLSA-2023:1583 |
| Rocky Linux:9 | nodejs | 1:16.19.1-1.el9_2 | RLSA-2023:2655 |
| Rocky Linux:8 | nodejs-nodemon | 0:2.0.20-2.module+el8.7.0+1108+49363b0d | RLSA-2023:1583 |
| Rocky Linux:8 | nodejs-nodemon | 0:2.0.20-3.module+el8.7.0+1178+d52dba78 | RLSA-2023:1582 |
| Rocky Linux:9 | nodejs-nodemon | 0:2.0.20-3.el9_2 | RLSA-2023:2655 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-4.module+el8.7.0+1072+5b168780 | RLSA-2023:1583 |
| Rocky Linux:8 | nodejs-packaging | 0:25-1.module+el8.6.0+1046+80feca58 | RLSA-2023:1582 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.7.0+40025+0e0cf6b2 | RLSA-2023:2654 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.7.0+40022+9ecc286c | RLSA-2023:2654 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.7.0+40017+f0db1785 | RLSA-2023:2654 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.7.0+40018+a011993d | RLSA-2023:2654 |
| npm | undici | 5.19.1 | GHSA-r6ch-mqf9-qc9w |
Affected products (as reported)
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w x_refsource_CONFIRM
- https://github.com/nodejs/undici/commit/f2324e549943f0b0937b09fb1c0c16cc7c93abdf x_refsource_MISC
- https://github.com/nodejs/undici/releases/tag/v5.19.1 x_refsource_MISC
- https://hackerone.com/bugs?report_id=1784449 x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20230324-0010/