5.3
Moyenne
CVE-2022-31150 undici is an HTTP/1.1 client, written from scratch for Node.js
Description
undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate `\r\n` is a workaround for this issue.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| undici 5.8 | 5.8.0 → < 5.7.1 | 5.7.1 |
Références
- github.com github.com
- hackerone.com hackerone.com
- github.com github.com
- security.netapp.com security.netapp.com
Chronologie
- Publiée
- Dernière modification