Every CVE Search/ Get API key

CVE-2023-24807

Undici vulnerable to Regular Expression Denial of Service in Headers

7.5 HighFix available

Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.31%Up 0.3 points since Feb 17, 2023
90%50%10%1%

What each source reports

CVE List Score used 7.5

Undici vulnerable to Regular Expression Denial of Service in Headers

Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.

Record
CVE-2023-24807
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
EUVDEUVD-2023-0786 7.5

Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.

Record
EUVD-2023-0786
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-r6ch-mqf9-qc9w 7.5

Regular Expression Denial of Service in Headers

Impact

The Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function.

Patches

This vulnerability was patched in v5.19.1.

Workarounds

There is no workaround. Please update to an unaffected version.

References

Credits

Carter Snook reported this vulnerability.

Record
GHSA-r6ch-mqf9-qc9w
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
NVD 7.5

Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.

Record
CVE-2023-24807
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20, CWE-1333
Updated
2026-11-02
OSVALPINE-CVE-2023-24807 7.5

Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.

Record
ALPINE-CVE-2023-24807
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-13585 7.5

CVE-2023-24807 affecting package nodejs for versions less than 16.19.1-1

Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.

Record
AZL-13585
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 25 moreShow less
OSVBELL-CVE-2023-24807 7.5

CVE-2023-24807 does not affect BellSoft software

Record
BELL-CVE-2023-24807
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 7.5

Undici vulnerable to Regular Expression Denial of Service in Headers

Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.

Record
CVE-2023-24807
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
OSVDEBIAN-CVE-2023-24807 7.5

Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.

Record
DEBIAN-CVE-2023-24807
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGHSA-r6ch-mqf9-qc9w 7.5

Regular Expression Denial of Service in Headers

Impact

The Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function.

Patches

This vulnerability was patched in v5.19.1.

Workarounds

There is no workaround. Please update to an unaffected version.

References

Credits

Carter Snook reported this vulnerability.

Record
GHSA-r6ch-mqf9-qc9w
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
OSVRHSA-2023:1582 8.6

Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update

Record
RHSA-2023:1582
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2023:1583 7.5

Red Hat Security Advisory: nodejs:18 security, bug fix, and enhancement update

Record
RHSA-2023:1583
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2023:2654 8.6

Red Hat Security Advisory: nodejs:18 security, bug fix, and enhancement update

Record
RHSA-2023:2654
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2023:2655 8.6

Red Hat Security Advisory: nodejs and nodejs-nodemon security, bug fix, and enhancement update

Record
RHSA-2023:2655
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2023:5533 8.8

Red Hat Security Advisory: nodejs security, bug fix, and enhancement update

Record
RHSA-2023:5533
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2023:2654 8.6

Moderate: nodejs:18 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (18.14.2).

Security Fix(es):

  • glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

  • c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

  • http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

  • Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)

  • Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)

  • Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)

  • Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

  • Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2023:2654
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVALSA-2023:1582 No score

Moderate: nodejs:16 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.19.1).

Security Fix(es):

  • glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
  • c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
  • http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
  • Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
  • Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)
  • Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)
  • Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
  • Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:1582
Updated
2026-11-02
OSVALSA-2023:1583 No score

Moderate: nodejs:18 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (18.14.2).

Security Fix(es):

  • glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
  • http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
  • Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
  • Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)
  • Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
  • Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:1583
Updated
2026-11-02
OSVALSA-2023:2654 No score

Moderate: nodejs:18 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (18.14.2).

Security Fix(es):

  • glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
  • c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
  • http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
  • Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
  • Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)
  • Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)
  • Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
  • Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:2654
Updated
2026-11-02
OSVALSA-2023:2655 No score

Moderate: nodejs and nodejs-nodemon security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.19.1), nodejs-nodemon (2.0.20).

Security Fix(es):

  • c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
  • http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
  • Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
  • Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)
  • Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
  • Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:2655
Updated
2026-11-02
OSVCLSA-2026-1788560495 No score

TuxCare security update for undici (14 CVEs)

TuxCare rebuilt undici to address 14 CVEs. Fixed in 5.5.1-tuxcare.1.

Record
CLSA-2026-1788560495
Updated
2026-11-02
OSVopenSUSE-SU-2024:12725-1 No score

corepack18-18.14.2-1.1 on GA media

These are all security issues fixed in the corepack18-18.14.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12725-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12726-1 No score

corepack19-19.7.0-1.1 on GA media

These are all security issues fixed in the corepack19-19.7.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12726-1
Updated
2026-11-02
OSVRLSA-2023:1582 No score

Moderate: nodejs:16 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.19.1).

Security Fix(es):

  • glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

  • c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

  • http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

  • Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)

  • Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)

  • Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)

  • Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

  • Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2023:1582
Updated
2026-11-02
OSVRLSA-2023:1583 No score

Moderate: nodejs:18 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (18.14.2).

Security Fix(es):

  • glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

  • http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

  • Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)

  • Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)

  • Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

  • Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2023:1583
Updated
2026-11-02
OSVRLSA-2023:2655 No score

Moderate: nodejs and nodejs-nodemon security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.19.1), nodejs-nodemon (2.0.20).

Security Fix(es):

  • c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

  • http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

  • Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)

  • Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)

  • Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

  • Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2023:2655
Updated
2026-11-02
OSVSUSE-SU-2023:0608-1 No score

Security update for nodejs16

This update for nodejs16 fixes the following issues:

Update to LTS version 16.19.1:

  • CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule (bsc#1208481).
  • CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library (bsc#1208483).
  • CVE-2023-23920: Fixed insecure loading of ICU data through ICU_DATA environment (bsc#1208487).
  • CVE-2023-23936: Fixed protection against CRLF injection in host headers inside fetch API (bsc#1208485).
  • CVE-2023-24807: Fixed possible Regular Expression Denial of Service (ReDoS) via Headers.set() and Headers.append() methods (bsc#1208413).

Bug fixes:

  • Workaround for failing openssl-nodejs test (bsc#1205568).
Record
SUSE-SU-2023:0608-1
Updated
2026-11-02
OSVSUSE-SU-2023:0609-1 No score

Security update for nodejs16

This update for nodejs16 fixes the following issues:

Update to LTS version 16.19.1:

  • CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule (bsc#1208481).
  • CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library (bsc#1208483).
  • CVE-2023-23920: Fixed insecure loading of ICU data through ICU_DATA environment (bsc#1208487).
  • CVE-2023-23936: Fixed protection against CRLF injection in host headers inside fetch API (bsc#1208485).
  • CVE-2023-24807: Fixed possible Regular Expression Denial of Service (ReDoS) via Headers.set() and Headers.append() methods (bsc#1208413).

Bug fixes:

  • Workaround for failing openssl-nodejs test (bsc#1205568).
Record
SUSE-SU-2023:0609-1
Updated
2026-11-02
OSVSUSE-SU-2023:0673-1 No score

Security update for nodejs16

This update for nodejs16 fixes the following issues:

Update to LTS version 16.19.1:

  • CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule (bsc#1208481).
  • CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library (bsc#1208483).
  • CVE-2023-23920: Fixed insecure loading of ICU data through ICU_DATA environment (bsc#1208487).
  • CVE-2023-23936: Fixed protection against CRLF injection in host headers inside fetch API (bsc#1208485).
  • CVE-2023-24807: Fixed possible Regular Expression Denial of Service (ReDoS) via Headers.set() and Headers.append() methods (bsc#1208413).

Bug fixes:

  • Workaround for failing openssl-nodejs test (bsc#1205568).
Record
SUSE-SU-2023:0673-1
Updated
2026-11-02
OSVSUSE-SU-2023:0715-1 No score

Security update for nodejs18

This update for nodejs18 fixes the following issues:

Update to NodeJS 18.14.2 LTS:

  • CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule (bsc#1208481).
  • CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library (bsc#1208483).
  • CVE-2023-23920: Fixed insecure loading of ICU data through ICU_DATA environment (bsc#1208487).
  • CVE-2023-23936: Fixed protection against CRLF injection in host headers inside fetch API (bsc#1208485).
  • CVE-2023-24807: Fixed possible Regular Expression Denial of Service (ReDoS) via Headers.set() and Headers.append() methods (bsc#1208413).
Record
SUSE-SU-2023:0715-1
Updated
2026-11-02
OSVSUSE-SU-2023:0738-1 No score

Security update for nodejs18

This update for nodejs18 fixes the following issues:

Update to NodeJS 18.14.2 LTS:

  • CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule (bsc#1208481).
  • CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library (bsc#1208483).
  • CVE-2023-23920: Fixed insecure loading of ICU data through ICU_DATA environment (bsc#1208487).
  • CVE-2023-23936: Fixed protection against CRLF injection in host headers inside fetch API (bsc#1208485).
  • CVE-2023-24807: Fixed possible Regular Expression Denial of Service (ReDoS) via Headers.set() and Headers.append() methods (bsc#1208413).
Record
SUSE-SU-2023:0738-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
undici
npm
 before 5.19.1
5.19.1
nodejs
Alpine:v3.15
 before 16.19.1-r0
16.19.1-r0
nodejs
Alpine:v3.16
 before 16.19.1-r0
16.19.1-r0
nodejs
Alpine:v3.17
 before 18.14.1-r0
18.14.1-r0
nodejs
Alpine:v3.18
 before 18.14.1-r0
18.14.1-r0
nodejs
Alpine:v3.19
 before 18.14.1-r0
18.14.1-r0
nodejs
Alpine:v3.20
 before 18.14.1-r0
18.14.1-r0
nodejs
Alpine:v3.21
 before 18.14.1-r0
18.14.1-r0
nodejs
Alpine:v3.22
 before 18.14.1-r0
18.14.1-r0
nodejs
Alpine:v3.23
 before 18.14.1-r0
18.14.1-r0
Show 106 moreShow less
Affected packages
PackageAffectedFixed
nodejs
Alpine:v3.24
 before 18.14.1-r0
18.14.1-r0
nodejs
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:16.19.1-1.module_el8.7.0+3496+a59a3324
1:16.19.1-1.module_el8.7.0+3496+a59a3324
nodejs-devel
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:16.19.1-1.module_el8.7.0+3496+a59a3324
1:16.19.1-1.module_el8.7.0+3496+a59a3324
nodejs-docs
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:16.19.1-1.module_el8.7.0+3496+a59a3324
1:16.19.1-1.module_el8.7.0+3496+a59a3324
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:16.19.1-1.module_el8.7.0+3496+a59a3324
1:16.19.1-1.module_el8.7.0+3496+a59a3324
nodejs-nodemon
AlmaLinux:8
From an advisory covering 8 CVEs
 before 2.0.20-3.module_el8.7.0+3496+a59a3324
2.0.20-3.module_el8.7.0+3496+a59a3324
nodejs-packaging
AlmaLinux:8
From an advisory covering 8 CVEs
 before 25-1.module_el8.5.0+2605+45d748af
25-1.module_el8.5.0+2605+45d748af
npm
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:8.19.3-1.16.19.1.1.module_el8.7.0+3496+a59a3324
1:8.19.3-1.16.19.1.1.module_el8.7.0+3496+a59a3324
nodejs
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:18.14.2-2.module_el8.7.0+3497+c65299e7
1:18.14.2-2.module_el8.7.0+3497+c65299e7
nodejs-devel
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:18.14.2-2.module_el8.7.0+3497+c65299e7
1:18.14.2-2.module_el8.7.0+3497+c65299e7
nodejs-docs
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:18.14.2-2.module_el8.7.0+3497+c65299e7
1:18.14.2-2.module_el8.7.0+3497+c65299e7
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:18.14.2-2.module_el8.7.0+3497+c65299e7
1:18.14.2-2.module_el8.7.0+3497+c65299e7
nodejs-nodemon
AlmaLinux:8
From an advisory covering 7 CVEs
 before 2.0.20-2.module_el8.7.0+3497+c65299e7
2.0.20-2.module_el8.7.0+3497+c65299e7
nodejs-packaging
AlmaLinux:8
From an advisory covering 7 CVEs
 before 2021.06-4.module_el8.7.0+3343+ea2b7901
2021.06-4.module_el8.7.0+3343+ea2b7901
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 7 CVEs
 before 2021.06-4.module_el8.7.0+3343+ea2b7901
2021.06-4.module_el8.7.0+3343+ea2b7901
npm
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:9.5.0-1.18.14.2.2.module_el8.7.0+3497+c65299e7
1:9.5.0-1.18.14.2.2.module_el8.7.0+3497+c65299e7
nodejs
AlmaLinux:9
From an advisory covering 8 CVEs
 before 1:18.14.2-2.module_el9.2.0+29+de583a0b
1:18.14.2-2.module_el9.2.0+29+de583a0b
nodejs-devel
AlmaLinux:9
From an advisory covering 8 CVEs
 before 1:18.14.2-2.module_el9.2.0+29+de583a0b
1:18.14.2-2.module_el9.2.0+29+de583a0b
nodejs-docs
AlmaLinux:9
From an advisory covering 8 CVEs
 before 1:18.14.2-2.module_el9.2.0+29+de583a0b
1:18.14.2-2.module_el9.2.0+29+de583a0b
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 8 CVEs
 before 1:18.14.2-2.module_el9.2.0+29+de583a0b
1:18.14.2-2.module_el9.2.0+29+de583a0b
nodejs-nodemon
AlmaLinux:9
From an advisory covering 8 CVEs
 before 2.0.20-2.module_el9.2.0+29+de583a0b
2.0.20-2.module_el9.2.0+29+de583a0b
nodejs-packaging
AlmaLinux:9
From an advisory covering 8 CVEs
 before 2021.06-4.module_el9.1.0+13+d9a595ea
2021.06-4.module_el9.1.0+13+d9a595ea
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 8 CVEs
 before 2021.06-4.module_el9.1.0+13+d9a595ea
2021.06-4.module_el9.1.0+13+d9a595ea
npm
AlmaLinux:9
From an advisory covering 8 CVEs
 before 1:9.5.0-1.18.14.2.2.module_el9.2.0+29+de583a0b
1:9.5.0-1.18.14.2.2.module_el9.2.0+29+de583a0b
nodejs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:16.19.1-1.el9_2
1:16.19.1-1.el9_2
nodejs-docs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:16.19.1-1.el9_2
1:16.19.1-1.el9_2
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:16.19.1-1.el9_2
1:16.19.1-1.el9_2
nodejs-libs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:16.19.1-1.el9_2
1:16.19.1-1.el9_2
npm
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:8.19.3-1.16.19.1.1.el9_2
1:8.19.3-1.16.19.1.1.el9_2
nodejs
Azure Linux:2
 before 16.19.1-1
16.19.1-1
undici
TuxCare:npm
From an advisory covering 14 CVEs
 5.5.1-tuxcare.0 up to 5.5.1-tuxcare.1, plus listed versions
5.5.1
5.5.1-tuxcare.1
node-undici
Debian:12
 before 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1, plus listed versions
5.15.0+dfsg1+~cs20.10.9.3-1
5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1
node-undici
Debian:13
 before 5.19.1+dfsg1+~cs20.10.9.5-1
5.19.1+dfsg1+~cs20.10.9.5-1
node-undici
Debian:14
 before 5.19.1+dfsg1+~cs20.10.9.5-1
5.19.1+dfsg1+~cs20.10.9.5-1
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:16.19.1-1.module+el8.7.0+18373+704f5cef
1:16.19.1-1.module+el8.7.0+18373+704f5cef
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:16.19.1-1.module+el8.7.0+18373+704f5cef
1:16.19.1-1.module+el8.7.0+18373+704f5cef
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:16.19.1-1.module+el8.7.0+18373+704f5cef
1:16.19.1-1.module+el8.7.0+18373+704f5cef
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:16.19.1-1.module+el8.7.0+18373+704f5cef
1:16.19.1-1.module+el8.7.0+18373+704f5cef
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:16.19.1-1.module+el8.7.0+18373+704f5cef
1:16.19.1-1.module+el8.7.0+18373+704f5cef
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:16.19.1-1.module+el8.7.0+18373+704f5cef
1:16.19.1-1.module+el8.7.0+18373+704f5cef
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:2.0.20-3.module+el8.7.0+18373+704f5cef
0:2.0.20-3.module+el8.7.0+18373+704f5cef
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:25-1.module+el8.5.0+10992+fac5fe06
0:25-1.module+el8.5.0+10992+fac5fe06
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef
1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:18.14.2-2.module+el8.7.0+18445+9493b6ea
1:18.14.2-2.module+el8.7.0+18445+9493b6ea
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:18.14.2-2.module+el8.7.0+18445+9493b6ea
1:18.14.2-2.module+el8.7.0+18445+9493b6ea
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:18.14.2-2.module+el8.7.0+18445+9493b6ea
1:18.14.2-2.module+el8.7.0+18445+9493b6ea
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:18.14.2-2.module+el8.7.0+18445+9493b6ea
1:18.14.2-2.module+el8.7.0+18445+9493b6ea
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:18.14.2-2.module+el8.7.0+18445+9493b6ea
1:18.14.2-2.module+el8.7.0+18445+9493b6ea
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:18.14.2-2.module+el8.7.0+18445+9493b6ea
1:18.14.2-2.module+el8.7.0+18445+9493b6ea
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 0:2.0.20-2.module+el8.7.0+18445+9493b6ea
0:2.0.20-2.module+el8.7.0+18445+9493b6ea
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 0:2021.06-4.module+el8.7.0+15582+19c314fa
0:2021.06-4.module+el8.7.0+15582+19c314fa
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 0:2021.06-4.module+el8.7.0+15582+19c314fa
0:2021.06-4.module+el8.7.0+15582+19c314fa
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea
1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 1:18.14.2-2.module+el9.2.0.z+18497+a402347c
1:18.14.2-2.module+el9.2.0.z+18497+a402347c
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 1:18.14.2-2.module+el9.2.0.z+18497+a402347c
1:18.14.2-2.module+el9.2.0.z+18497+a402347c
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 1:18.14.2-2.module+el9.2.0.z+18497+a402347c
1:18.14.2-2.module+el9.2.0.z+18497+a402347c
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 1:18.14.2-2.module+el9.2.0.z+18497+a402347c
1:18.14.2-2.module+el9.2.0.z+18497+a402347c
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 1:18.14.2-2.module+el9.2.0.z+18497+a402347c
1:18.14.2-2.module+el9.2.0.z+18497+a402347c
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 1:18.14.2-2.module+el9.2.0.z+18497+a402347c
1:18.14.2-2.module+el9.2.0.z+18497+a402347c
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:2.0.20-2.module+el9.2.0.z+18497+a402347c
0:2.0.20-2.module+el9.2.0.z+18497+a402347c
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:2021.06-4.module+el9.1.0+15718+e52ec601
0:2021.06-4.module+el9.1.0+15718+e52ec601
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:2021.06-4.module+el9.1.0+15718+e52ec601
0:2021.06-4.module+el9.1.0+15718+e52ec601
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c
1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:16.19.1-1.el9_2
1:16.19.1-1.el9_2
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:16.19.1-1.el9_2
1:16.19.1-1.el9_2
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:16.19.1-1.el9_2
1:16.19.1-1.el9_2
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:16.19.1-1.el9_2
1:16.19.1-1.el9_2
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:16.19.1-1.el9_2
1:16.19.1-1.el9_2
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:16.19.1-1.el9_2
1:16.19.1-1.el9_2
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:16.19.1-1.el9_2
1:16.19.1-1.el9_2
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:2.0.20-3.el9_2
0:2.0.20-3.el9_2
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:8.19.3-1.16.19.1.1.el9_2
1:8.19.3-1.16.19.1.1.el9_2
nodejs
Red Hat:rhel_eus:9.0::appstream
From an advisory covering 12 CVEs
 before 1:16.20.2-1.el9_0
1:16.20.2-1.el9_0
nodejs-debuginfo
Red Hat:rhel_eus:9.0::appstream
From an advisory covering 12 CVEs
 before 1:16.20.2-1.el9_0
1:16.20.2-1.el9_0
nodejs-debugsource
Red Hat:rhel_eus:9.0::appstream
From an advisory covering 12 CVEs
 before 1:16.20.2-1.el9_0
1:16.20.2-1.el9_0
nodejs-docs
Red Hat:rhel_eus:9.0::appstream
From an advisory covering 12 CVEs
 before 1:16.20.2-1.el9_0
1:16.20.2-1.el9_0
nodejs-full-i18n
Red Hat:rhel_eus:9.0::appstream
From an advisory covering 12 CVEs
 before 1:16.20.2-1.el9_0
1:16.20.2-1.el9_0
nodejs-libs
Red Hat:rhel_eus:9.0::appstream
From an advisory covering 12 CVEs
 before 1:16.20.2-1.el9_0
1:16.20.2-1.el9_0
nodejs-libs-debuginfo
Red Hat:rhel_eus:9.0::appstream
From an advisory covering 12 CVEs
 before 1:16.20.2-1.el9_0
1:16.20.2-1.el9_0
npm
Red Hat:rhel_eus:9.0::appstream
From an advisory covering 12 CVEs
 before 1:8.19.4-1.16.20.2.1.el9_0
1:8.19.4-1.16.20.2.1.el9_0
nodejs
Rocky Linux:8
From an advisory covering 8 CVEs
 before 1:16.19.1-1.module+el8.7.0+1178+d52dba78
1:16.19.1-1.module+el8.7.0+1178+d52dba78
nodejs-nodemon
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:2.0.20-3.module+el8.7.0+1178+d52dba78
0:2.0.20-3.module+el8.7.0+1178+d52dba78
nodejs-packaging
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:25-1.module+el8.6.0+1046+80feca58
0:25-1.module+el8.6.0+1046+80feca58
nodejs
Rocky Linux:8
From an advisory covering 6 CVEs
 before 1:18.14.2-2.module+el8.7.0+1177+510ae886
1:18.14.2-2.module+el8.7.0+1177+510ae886
nodejs-nodemon
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:2.0.20-2.module+el8.7.0+1108+49363b0d
0:2.0.20-2.module+el8.7.0+1108+49363b0d
nodejs-packaging
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:2021.06-4.module+el8.7.0+1072+5b168780
0:2021.06-4.module+el8.7.0+1072+5b168780
nodejs-packaging
Rocky Linux:9
From an advisory covering 8 CVEs
 before 0:2021.06-4.module+el9.7.0+40025+0e0cf6b2
0:2021.06-4.module+el9.7.0+40025+0e0cf6b2
nodejs-packaging
Rocky Linux:9
From an advisory covering 8 CVEs
 before 0:2021.06-4.module+el9.7.0+40017+f0db1785
0:2021.06-4.module+el9.7.0+40017+f0db1785
nodejs-packaging
Rocky Linux:9
From an advisory covering 8 CVEs
 before 0:2021.06-4.module+el9.7.0+40018+a011993d
0:2021.06-4.module+el9.7.0+40018+a011993d
nodejs-packaging
Rocky Linux:9
From an advisory covering 8 CVEs
 before 0:2021.06-4.module+el9.7.0+40022+9ecc286c
0:2021.06-4.module+el9.7.0+40022+9ecc286c
nodejs
Rocky Linux:9
From an advisory covering 6 CVEs
 before 1:16.19.1-1.el9_2
1:16.19.1-1.el9_2
nodejs-nodemon
Rocky Linux:9
From an advisory covering 6 CVEs
 before 0:2.0.20-3.el9_2
0:2.0.20-3.el9_2
nodejs16
SUSE:Linux Enterprise Module for Web and Scripting 15 SP4
From an advisory covering 5 CVEs
 before 16.19.1-150400.3.15.1
16.19.1-150400.3.15.1
nodejs16
openSUSE:Leap 15.4
From an advisory covering 5 CVEs
 before 16.19.1-150400.3.15.1
16.19.1-150400.3.15.1
nodejs16
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 5 CVEs
 before 16.19.1-8.24.1
16.19.1-8.24.1
nodejs16
SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS
From an advisory covering 5 CVEs
 before 16.19.1-150300.7.18.1
16.19.1-150300.7.18.1
nodejs16
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
From an advisory covering 5 CVEs
 before 16.19.1-150300.7.18.1
16.19.1-150300.7.18.1
nodejs16
SUSE:Linux Enterprise Server 15 SP3-LTSS
From an advisory covering 5 CVEs
 before 16.19.1-150300.7.18.1
16.19.1-150300.7.18.1
nodejs16
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
From an advisory covering 5 CVEs
 before 16.19.1-150300.7.18.1
16.19.1-150300.7.18.1
nodejs16
SUSE:Manager Server 4.2
From an advisory covering 5 CVEs
 before 16.19.1-150300.7.18.1
16.19.1-150300.7.18.1
nodejs16
SUSE:Enterprise Storage 7.1
From an advisory covering 5 CVEs
 before 16.19.1-150300.7.18.1
16.19.1-150300.7.18.1
nodejs18
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 5 CVEs
 before 18.14.2-8.6.2
18.14.2-8.6.2
nodejs18
SUSE:Linux Enterprise Module for Web and Scripting 15 SP4
From an advisory covering 5 CVEs
 before 18.14.2-150400.9.6.2
18.14.2-150400.9.6.2
nodejs18
openSUSE:Leap 15.4
From an advisory covering 5 CVEs
 before 18.14.2-150400.9.6.2
18.14.2-150400.9.6.2
nodejs18
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 18.14.2-1.1
18.14.2-1.1
nodejs19
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 19.7.0-1.1
19.7.0-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-24807 is a high vulnerability (CVSS 7.5) in Nodejs Undici, published February 16, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.31%, the 70th percentile. Fixed in undici 5.19.1.

References

Show 120 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open