AZL-13585

See a problem?
Import Source
https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-13585.json
JSON Data
https://api.test.osv.dev/v1/vulns/AZL-13585
Upstream
Published
2023-02-16T18:15:12Z
Modified
2026-04-01T05:08:37.533257Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
CVE-2023-24807 affecting package nodejs for versions less than 16.19.1-1
Details

Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.

References

Affected packages

Azure Linux:2 / nodejs

Package

Name
nodejs
Purl
pkg:rpm/azure-linux/nodejs

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
16.19.1-1

Database specific

source 
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-13585.json"