High severity · published Feb 16, 2023
CVE-2023-24807
Undici is an HTTP/1.1 client for Node.js
7.5
CVSS
1.3%
EPSS
No
On KEV
Description
Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UN
Undici · Nodejs
before 5.19.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-24807
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-24807
Patch
https://github.com/nodejs/undici/commit/f2324e549943f0b0937b09fb1c0c16cc7c93abdf
Release Notes
https://github.com/nodejs/undici/releases/tag/v5.19.1
Vendor Advisory
https://github.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w
Permissions Required
https://hackerone.com/bugs?report_id=1784449
security.netapp.com
https://security.netapp.com/advisory/ntap-20230324-0010/
More from Undici
9.8
CVE-2026-1525
undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
9.8
CVE-2022-35949
undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the…
9.1
CVE-2026-109383
undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent
9.1
CVE-2026-109829
undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects
9.1
CVE-2026-84961
undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool