CVE-2023-24807: Undici vulnerable to Regular Expression Denial of Service in Headers
Node.js is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) flaw in the Headers.set() and Headers.append() methods in the fetch API. By sending a specially-crafted regex input, a remote attacker could exploit this vulnerability to cause a denial of service condition.
Other sources
The Headers.set() and Headers.append() methods in the fetch API in Node.js where vulnerable to Regular a Expression Denial of Service (ReDoS) attacks.
— Red Hat
Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2023-24807?
CVE-2023-24807 is a vulnerability in Node.js that allows for denial of service attacks due to regular expression denial of service (ReDoS).
How does CVE-2023-24807 affect Node.js?
CVE-2023-24807 affects Node.js by making the `Headers.set()` and `Headers.append()` methods vulnerable to ReDoS attacks when untrusted values are passed into the functions.
What is the severity level of CVE-2023-24807?
CVE-2023-24807 has a severity level of high with a CVSS score of 7.5.
How can I fix CVE-2023-24807?
To fix CVE-2023-24807, you should update your Node.js version to 19.6.1 or higher.
Where can I find more information about CVE-2023-24807?
You can find more information about CVE-2023-24807 on the Red Hat Bugzilla website: [link](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2172205)