CVSS 3.1
5.4 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NCVE-2023-23936
Medium (5.4) in nodejs. EPSS 1.1% chance of exploitation in the next 30 days. Fixed in undici 5.19.1.
Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.
Severity
- EPSS
- 1.1% chance of exploitation in the next 30 days; higher than 66% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-74, CWE-93
- Published
- Modified
- Record from
- the NVD, synced
Affected
- nodejs:node.js
- nodejs:undici
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-5r9g-qh6m-jxff | npm | undici | >=2.0.0 <5.19.1 | 5.19.1 |
References
- https://github.com/nodejs/undici/commit/a2eff05401358f6595138df963837c24348f2034
- https://github.com/nodejs/undici/releases/tag/v5.19.1
- https://github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxff
- https://hackerone.com/reports/1820955
- https://github.com/nodejs/undici/commit/a2eff05401358f6595138df963837c24348f2034