CVE-2023-23936
published 2023-02-16CVE-2023-23936: Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from…
PriorityP426medium5.4CVSS 3.1
AVNACLPRNUIRSUCLILAN
EPSS
1.13%
62.6th percentile
Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | node-undici | < node-undici 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1 (bookworm) | node-undici 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1 (bookworm) |
| msrc | cbl2_nodejs_16.19.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| nodejs | node.js | >= 16.0.0 < 16.19.1 | 16.19.1 |
| nodejs | node.js | >= 18.0.0 < 18.14.1 | 18.14.1 |
| nodejs | node.js | >= 19.0.0 < 19.6.1 | 19.6.1 |
| nodejs | undici | — | — |
| nodejs | undici | >= 2.0.0 < 5.19.1 | 5.19.1 |
| nodejs | undici | >= 2.0.0 < 5.19.1 | 5.19.1 |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
osv5.4MEDIUM
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
vendor_msrc5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
Node.js: Fetch API did not protect against CRLF injection in host headers
vendor_redhat·2023-02-16·CVSS 6.5
CVE-2023-23936 [MEDIUM] CWE-93 Node.js: Fetch API did not protect against CRLF injection in host headers
Node.js: Fetch API did not protect against CRLF injection in host headers
Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.
A flaw was found in the fetch API in Node.js that did not prevent CRLF injection in the 'host' header. This issue could allow HTTP response splitting and HTTP header injection.
Package: 3scale-amp-system-container (Red Hat 3scale API Management Platform 2) - Will not fix
Package: nodejs (Red Hat Enterprise Linux 8) - Not affected
Microsoft
CRLF Injection in Nodejs ‘undici’ via host
vendor_msrc·2023-02-14·CVSS 5.4
CVE-2023-23936 [MEDIUM] CWE-74 CRLF Injection in Nodejs ‘undici’ via host
CRLF Injection in Nodejs ‘undici’ via host
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.micros
Debian
CVE-2023-23936: node-undici - Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior ...
vendor_debian·2023·CVSS 6.5
CVE-2023-23936 [MEDIUM] CVE-2023-23936: node-undici - Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior ...
Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.
Scope: local
bookworm: resolved (fixed in 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1)
forky: resolved (fixed in 5.19.1+dfsg1+~cs20.10.9.5-1)
sid: resolved (fixed in 5.19.1+dfsg1+~cs20.10.9.5-1)
trixie: resolved (fixed in 5.19.1+dfsg1+~cs20.10.9.5-1)
OSV
CVE-2023-23936: Undici is an HTTP/1
osv·2023-02-16·CVSS 5.4
CVE-2023-23936 [MEDIUM] CVE-2023-23936: Undici is an HTTP/1
Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.
GHSA
CRLF Injection in Nodejs ‘undici’ via host
ghsa·2023-02-16
CVE-2023-23936 [MEDIUM] CWE-74 CRLF Injection in Nodejs ‘undici’ via host
CRLF Injection in Nodejs ‘undici’ via host
### Impact
undici library does not protect `host` HTTP header from CRLF injection vulnerabilities.
### Patches
This issue was patched in Undici v5.19.1.
### Workarounds
Sanitize the `headers.host` string before passing to undici.
### References
Reported at https://hackerone.com/reports/1820955.
### Credits
Thank you to Zhipeng Zhang ([@timon8](https://hackerone.com/timon8)) for reporting this vulnerability.
OSV
CRLF Injection in Nodejs ‘undici’ via host
osv·2023-02-16
CVE-2023-23936 [MEDIUM] CRLF Injection in Nodejs ‘undici’ via host
CRLF Injection in Nodejs ‘undici’ via host
### Impact
undici library does not protect `host` HTTP header from CRLF injection vulnerabilities.
### Patches
This issue was patched in Undici v5.19.1.
### Workarounds
Sanitize the `headers.host` string before passing to undici.
### References
Reported at https://hackerone.com/reports/1820955.
### Credits
Thank you to Zhipeng Zhang ([@timon8](https://hackerone.com/timon8)) for reporting this vulnerability.
No detection rules found.
No public exploits indexed.
https://github.com/nodejs/undici/commit/a2eff05401358f6595138df963837c24348f2034https://github.com/nodejs/undici/releases/tag/v5.19.1https://github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxffhttps://hackerone.com/reports/1820955https://github.com/nodejs/undici/commit/a2eff05401358f6595138df963837c24348f2034https://github.com/nodejs/undici/releases/tag/v5.19.1https://github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxffhttps://hackerone.com/reports/1820955
2023-02-16
Published