Description
undici library does not protect host HTTP header from CRLF injection vulnerabilities.
Recommendation
Update the undici package to the latest compatible version. Followings are version details:
- Affected version(s): >= 2.0.0, < 5.19.1
- Patched version(s): 5.19.1
References
Related Issues
- Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type - CVE-2022-35948
- matrix-appservice-irc IRC command injection via admin commands containing newlines - CVE-2023-38690
- CouchAuth host header injection vulnerability leaks the password reset token - CVE-2023-39655
- fast-xml-parser vulnerable to Regex Injection via Doctype Entities - CVE-2023-34104
- Tags:
- npm
- undici
Anything's wrong? Let us know Last updated on February 24, 2023