CVE-2023-24807: Undici vulnerable to Regular Expression Denial of Service in Headers

Vulnerability summary

CVE-2023-24807 is a high (CVSS 7.5) Improper Input Validation vulnerability in nodejs undici. EPSS estimates a 1.31% chance of exploitation in the next 30 days, higher than 70.7% of scored vulnerabilities.

Timeline

1. 16-02-2023
   PublishedVulnerability first disclosed.
2. 10-03-2025
   Last modifiedVulnerability information updated.

Description

Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
• CWE-1333Inefficient Regular Expression ComplexityThe product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.