Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-24807: Undici can be slowed by crafted HTTP headers

CVE-2023-24807 · published 3 years ago

Summary

The Undici HTTP client for Node.js versions before 5.19.1 could be forced to use excessive CPU when it processes specially crafted header values. This can make applications that rely on Undici unresponsive or slow. Upgrade Undici to version 5.19.1 or later to eliminate the issue.

What to do

Update GitHub Actions undici to version 5.19.1.
Update debian node-undici to version 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1.
Update debian node-undici to version 5.19.1+dfsg1+~cs20.10.9.5-1.
Update nodejs to version 16.19.1-r0.
Update nodejs to version 18.14.1-r0.
Update nodejs undici to version 5.19.1 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
npm	GitHub Actions	undici	< 5.19.1 Fix: upgrade to 5.19.1
–	nodejs	undici	< 5.19.1 `cpe:2.3:a:nodejs:undici::::::node.js::*`
Debian:12	debian	node-undici	< 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1 Fix: upgrade to 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1
Debian:13	debian	node-undici	< 5.19.1+dfsg1+~cs20.10.9.5-1 Fix: upgrade to 5.19.1+dfsg1+~cs20.10.9.5-1
Alpine:v3.15	–	nodejs	< 16.19.1-r0 Fix: upgrade to 16.19.1-r0
Alpine:v3.17	–	nodejs	< 18.14.1-r0 Fix: upgrade to 18.14.1-r0

Original advisory text

Undici vulnerable to Regular Expression Denial of Service in Headers

Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.

References

https://github.com/advisories/GHSA-r6ch-mqf9-qc9w
https://github.com/nodejs/undici/releases/tag/v5.19.1 URL
https://hackerone.com/bugs?report_id=1784449 URL
https://github.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-24807 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24807... Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2023-24807 Vendor Advisory
https://security.netapp.com/advisory/ntap-20230324-0010/ Vendor Advisory
https://github.com/nodejs/undici/commit/f2324e549943f0b0937b09fb1c0c16cc7c93abdf Patch
https://security.alpinelinux.org/vuln/CVE-2023-24807 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.5 High

Exploitation

1% chance of attack within 30 days

Type

CWE-1333Inefficient Regular Expression Complexity (ReDoS)

CWE-20Improper Input Validation

Timeline

Published16 Feb 2023

Updated4 Nov 2026

First seen6 Mar 2026

Sources

GHSA-r6ch-mqf9-qc9w · GHSA

CVE-2023-24807 · NVD

CVE-2023-24807 · OSV

DEBIAN-CVE-2023-24807 · OSV

ALPINE-CVE-2023-24807 · OSV

Track software like this

Free during beta