| Package | Affected versions | Patched versions |
|---|---|---|
| undici | < 5.19.1 | 5.19.1 |
| undici | < 5.19.1 | 5.19.1 |
The Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function.
This vulnerability was patched in v5.19.1.
There is no workaround. Please update to an unaffected version.
Carter Snook reported this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free