CVE-2023-23936: CRLF Injection in Nodejs ‘undici’ via host
A flaw was found in the fetch API in Node.js that did not prevent CRLF injection in the 'host' header. This issue could allow HTTP response splitting and HTTP header injection.
Other sources
Node.js is vulnerable to CRLF injection, caused by a flaw in the fetch API. By sending a specially-crafted HTTP response containing CRLF character sequences, a remote attacker could exploit this vulnerability to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning, session hijacking, HTTP response splitting or HTTP header injection.
— IBM
The fetch API in Node.js did not prevent CRLF injection in the 'host' header potentially allowing attacks such as HTTP response splitting and HTTP header injection.
— Red Hat
Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect host HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the headers.host string before passing to undici.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2023-23936?
CVE-2023-23936 is a vulnerability in the fetch API in Node.js that allows for CRLF injection in the host header.
What is the severity of CVE-2023-23936?
CVE-2023-23936 has a severity rating of 6.5 out of 10.
How does CVE-2023-23936 affect Node.js?
CVE-2023-23936 affects Node.js versions prior to 19.6.1, 18.14.1, and 16.19.1.
How can I fix CVE-2023-23936?
To fix CVE-2023-23936, update Node.js to version 19.6.1, 18.14.1, or 16.19.1.
Are there any workarounds for CVE-2023-23936?
As a workaround for CVE-2023-23936, sanitize the `headers.host` string before passing to the affected component.