Regular Expression Denial of Service in Headers

Description

The Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function.

Recommendation

Update the undici package to the latest compatible version. Followings are version details:

• Affected version(s): < 5.19.1
• Patched version(s): 5.19.1

References

• GHSA-r6ch-mqf9-qc9w
• hackerone.com
• CVE-2023-24807
• CWE-1333
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect - CVE-2024-30261
• Elliptic's EDDSA missing signature length check - CVE-2024-42459
• undici Denial of Service attack via bad certificate data - CVE-2025-47279
• Incorrect default cookie name and recommendation - Vulnerability

Tags:

npm

undici