CVE-2023-24807highCWE-20

CVE-2023-24807: fallo de gravedad alta en nodejs undici

Undici vulnerable to Regular Expression Denial of Service in Headers

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear undici+ Monitorear nodejs

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 1.3%
Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
nodejs · undici
CVEs relacionadas — nodejs undici

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-35949MEDIUM`undici.request` vulnerable to SSRF using absolute URL on `pathname`EPSS 1.9%CVE-2022-31150MEDIUMCRLF injection in request headersEPSS 1.5%CVE-2022-35948MEDIUMCRLF Injection in Nodejs ‘undici’ via Content-TypeEPSS 1.4%CVE-2023-45143LOWUndici's cookie header not cleared on cross-origin redirect in fetchEPSS 1.4%CVE-2023-23936MEDIUMCRLF Injection in Nodejs ‘undici’ via hostEPSS 1.1%CVE-2024-30261LOWUndici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrectEPSS 0.8%