Skip to content
Sign in
7.5 High

CVE-2023-24807 Undici is an HTTP/1.1 client for Node.js

Description

Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.

Affected products and versions

Product Affected versions Fixed in
undici 5.19 earliest → < 5.19.1 5.19.1

Other CVEs of undici

The 15 CVEs of undici →
CVE-2026-22036 Undici is an HTTP/1.1 client for Node.js 5.9 Medium CVE-2025-47279 Undici is an HTTP/1.1 client for Node.js 3.1 Low CVE-2025-22150 Undici is an HTTP/1.1 client 6.8 Medium CVE-2024-38372 Undici is an HTTP/1.1 client, written from scratch for Node.js 2.0 Low
Track this CVE