Homepage
About Snyk

CRLF Injection Affecting undici package, versions >=2.0.0 <5.19.1

0.0
medium

Snyk CVSS

    Attack Complexity Low
    User Interaction Required

    Threat Intelligence

    Exploit Maturity Proof of concept
    EPSS 0.13% (48th percentile)
Expand this section
NVD
5.4 medium
Expand this section
SUSE
6.5 medium
Expand this section
Red Hat
6.5 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-UNDICI-3323844
  • published 17 Feb 2023
  • disclosed 16 Feb 2023
  • credit Zhipeng Zhang
Report a new vulnerability Found a mistake?

Introduced: 16 Feb 2023

CVE-2023-23936 Open this link in a new tab
CWE-93 Open this link in a new tab

How to fix?

Upgrade undici to version 5.19.1 or higher.

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to CRLF Injection due to missing protection for the host HTTP header.

Workaround

Users who are unable to upgrade to the fixed version should sanitize the headers.host string before passing to undici.