CVE-2023-23936: CRLF Injection in Nodejs ‘undici’ via host
Vulnerability summary
CVE-2023-23936 is a medium (CVSS 6.5) vulnerability in nodejs node.js. EPSS estimates a 1.13% chance of exploitation in the next 30 days, higher than 66.4% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 10 · Related 5Timeline
- 16-02-2023PublishedVulnerability first disclosed.
- 10-03-2025Last modifiedVulnerability information updated.
Description
Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · AlpineEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NDiffers
- OSV · DebianEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NDiffers
- OSV · NpmEcosystem advisory · calculated4.6MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:NDiffers
- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NDiffers
EPSS trend
Probability
1.13%
Chance of exploitation in the next 30 days
Percentile
66%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.13% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-93Improper Neutralization of CRLF SequencesThe product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
- CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream ComponentThe product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Nodejs2 products
Alpine1 product
- nodejs< 16.19.1-r0 | < 18.14.1-r0
Debian1 product
- node-undici< 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1 | < 5.19.1+dfsg1+~cs20.10.9.5-1
Npm1 product
- undici≥ 2.0.0, < 5.19.1
4 vendors · 5 products
References
8 links- github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxffX Refsource CONFIRMWEBVendor Advisory
- github.com/nodejs/undiciPACKAGE