CRLF Injection Affecting undici package, versions >=2.0.0 <5.19.1
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.16% (53rd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-UNDICI-3323844
- published 17 Feb 2023
- disclosed 16 Feb 2023
- credit Zhipeng Zhang
Introduced: 16 Feb 2023
CVE-2023-23936 Open this link in a new tabHow to fix?
Upgrade undici to version 5.19.1 or higher.
Overview
undici is an An HTTP/1.1 client, written from scratch for Node.js
Affected versions of this package are vulnerable to CRLF Injection due to missing protection for the host HTTP header.
Workaround
Users who are unable to upgrade to the fixed version should sanitize the headers.host string before passing to undici.
References
CVSS Scores
version 3.1