CVE-2023-24807

Katalog CVE

CVSS 7.5 · High EPSS 1,3%

Kerentanan Improper Input Validation pada nodejs undici. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.

Rincian

Terbit di NVD

16 Februari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-1333: Inefficient Regular Expression Complexity

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 70,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w advisory vendor
• https://github.com/nodejs/undici/commit/f2324e549943f0b0937b09fb1c0c16cc7c93abdf patch
• https://hackerone.com/bugs?report_id=1784449 permissions required · advisory pihak ketiga
• https://github.com/nodejs/undici/releases/tag/v5.19.1 release notes
• https://security.netapp.com/advisory/ntap-20230324-0010/