Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2023-23936

Good to know:

icon
icon

Date: February 16, 2023

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect "host" HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the "headers.host" string before passing to undici.

Language: JS

Severity Score

Related Resources (10)

https://github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxff
https://hackerone.com/reports/1820955
https://security-tracker.debian.org/tracker/CVE-2023-23936
https://github.com/nodejs/undici/commit/a2eff05401358f6595138df963837c24348f2034
https://github.com/nodejs/undici
https://github.com/nodejs/undici/releases/tag/v5.19.1
https://access.redhat.com/security/cve/CVE-2023-23936
https://nvd.nist.gov/vuln/detail/CVE-2023-23936
https://security.alpinelinux.org/vuln/CVE-2023-23936
https://www.mend.io/vulnerability-database/CVE-2023-23936

Severity Score

Weakness Type (CWE)

Improper Neutralization of CRLF Sequences ('CRLF Injection')

CWE-93

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-74

Top Fix

icon

Upgrade Version

Upgrade to version undici - 5.19.1

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us