CVE-2023-23936

Aliases:GHSA-5r9g-qh6m-jxffBIT-node-2023-23936BIT-node-min-2023-23936
Advisory lineage Upstream: 0 Downstream: 12
Modified
Published: 16 Feb 2023, 17:30
Last modified:10 Mar 2025, 21:10

Vulnerability Summary

Overall Risk (default)
medium
36/100
CVSS Score
6.5 MEDIUM
v3.1 (cve.org)
EPSS Score
0.34% LOW
0% probability -0.15%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

16 Feb 2023, 17:30
Published
Vulnerability first disclosed
10 Mar 2025, 21:10
Last Modified
Vulnerability information updated

Description

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.

CVSS Metrics

  • v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
  • v3.1•MEDIUM•Score: 5.4CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
  • v3.1•MEDIUM•Score: 4.6CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

EPSS Trends

Current EPSS score: 0.34%• Percentile: 57%

Techniques & Countermeasures

  • CWE-93•Improper Neutralization of CRLF Sequences ('CRLF Injection')

    The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

  • CWE-74•Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

    The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Affected Systems

  • nodejs•node.js

    ≥ 16.0.0, < 16.19.1 | ≥ 18.0.0, < 18.14.1 | ≥ 19.0.0, < 19.6.1

  • nodejs•undici

    ≥ 2.0.0, < 5.19.1

  • Npm•undici

    ≥ 2.0.0, < 5.19.1

References (6)