CVE-2023-24807

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20 CWE-1333

Affected software

No affected versions have been published.

Timeline

Published: Feb 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-248086.5PDFio is a C library for reading and writing PDF files. In versions prior to 1.1.0 a denial of service (DOS) vulnerability exists in the pdf CVE-2023-248095.5NetHack is a single player dungeon exploration game. Starting with version 3.6.2 and prior to version 3.6.7, illegal input to the "C" (call)CVE-2023-24817.5Compiler removal of buffer clearing in sli_se_opaque_import_key in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key CVE-2023-248106.1Misskey is an open source, decentralized social media platform. Due to insufficient validation of the redirect URL during `miauth` authentic CVE-2023-248116.1Misskey is an open source, decentralized social media platform. In versions prior to 13.3.2 the URL preview function is subject to a cross s CVE-2023-248129.8Misskey is an open source, decentralized social media platform. In versions prior to 13.3.3 SQL injection is possible due to insufficient pa CVE-2023-248139.8Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and php-svg-lib, an attacker can CVE-2023-248146.1TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. In affected versions the TYPO3 c CVE-2023-248155.3Vert.x-Web is a set of building blocks for building web applications in the java programming language. When running vertx web applications t CVE-2023-248167.0IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Py CVE-2023-248177.5RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prio CVE-2023-248187.5RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames.