AZL-13604

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-13604.json

JSON Data

https://api.test.osv.dev/v1/vulns/AZL-13604

Upstream

CVE-2023-23936

Published

2023-02-16T18:15:10Z

Modified

2026-04-01T05:07:42.984789Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS Calculator

Summary

CVE-2023-23936 affecting package nodejs for versions less than 16.19.1-1

Details

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect host HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the headers.host string before passing to undici.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-23936

Affected packages

Azure Linux:2 / nodejs

Package

Name: nodejs
Purl: pkg:rpm/azure-linux/nodejs

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

16.19.1-1

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-13604.json"