Regular Expression Denial of Service in Headers

CAO 7.5CVE-2023-24807 · GHSA-r6ch-mqf9-qc9w · Công bố 16/02/2023 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2023-24807 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng undici (nodejs), undici.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.3%, cao hơn 70.8% các lỗ hổng khác.
Cách xử lý: cập nhật lên 5.19.1 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
undici nodejs	`< 5.19.1`	`5.19.1`
undici npm	`< 5.19.1`	`5.19.1`

Mô tả

Impact

The Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function.

Patches

This vulnerability was patched in v5.19.1.

Workarounds

There is no workaround. Please update to an unaffected version.

References

https://hackerone.com/bugs?report_id=1784449

Credits

Carter Snook reported this vulnerability.

Mô tả của NVD

Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.