CVE-2023-24807: Undici vulnerable to Regular Expression Denial of Service in Headers
Node.js is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) flaw in the Headers.set() and Headers.append() methods in the fetch API. By sending a specially-crafted regex input, a remote attacker could exploit this vulnerability to cause a denial of service condition.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-24807?
CVE-2023-24807 is a vulnerability in Node.js that allows for denial of service attacks due to regular expression denial of service (ReDoS).
How does CVE-2023-24807 affect Node.js?
CVE-2023-24807 affects Node.js by making the `Headers.set()` and `Headers.append()` methods vulnerable to ReDoS attacks when untrusted values are passed into the functions.
What is the severity level of CVE-2023-24807?
CVE-2023-24807 has a severity level of high with a CVSS score of 7.5.
How can I fix CVE-2023-24807?
To fix CVE-2023-24807, you should update your Node.js version to 19.6.1 or higher.
Where can I find more information about CVE-2023-24807?
You can find more information about CVE-2023-24807 on the Red Hat Bugzilla website: [link](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2172205)