Regular Expression Denial of Service in Headers

Description

The Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function.

Recommendation

Update the undici package to the latest compatible version. Followings are version details:

• Affected version(s): < 5.19.1
• Patched version(s): 5.19.1

References

• GHSA-r6ch-mqf9-qc9w
• hackerone.com
• CVE-2023-24807
• CWE-1333
• CAPEC-310
• OWASP 2021-A6

Related Issues

• undici Denial of Service attack via bad certificate data - CVE-2025-47279
• Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline - CVE-2024-30260
• Use of Insufficiently Random Values in undici - CVE-2025-22150
• Incorrect default cookie name and recommendation - Vulnerability

Tags:

npm

undici