Every CVE Search/ Get API key

CVE-2023-23936

CRLF Injection in Nodejs ‘undici’ via host

6.5 MediumFix available

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect host HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the headers.host string before passing to undici.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

1.13%Up 0.1 points since Feb 17, 2023
90%50%10%1%

What each source reports

CVE List Score used 6.5

CRLF Injection in Nodejs ‘undici’ via host

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect host HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the headers.host string before passing to undici.

Record
CVE-2023-23936
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-93
Updated
2026-11-02
EUVDEUVD-2023-0633 6.5

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect host HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the headers.host string before passing to undici.

Record
EUVD-2023-0633
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-5r9g-qh6m-jxff 4.6

CRLF Injection in Nodejs ‘undici’ via host

Impact

undici library does not protect host HTTP header from CRLF injection vulnerabilities.

Patches

This issue was patched in Undici v5.19.1.

Workarounds

Sanitize the headers.host string before passing to undici.

References

Reported at https://hackerone.com/reports/1820955.

Credits

Thank you to Zhipeng Zhang (@timon8) for reporting this vulnerability.

Record
GHSA-5r9g-qh6m-jxff
CVSS 3.1
4.6 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-74, CWE-93
Updated
2026-11-02
NVD 6.5

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect host HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the headers.host string before passing to undici.

Record
CVE-2023-23936
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-93, CWE-74
Updated
2026-11-02
OSVALPINE-CVE-2023-23936 5.4

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect host HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the headers.host string before passing to undici.

Record
ALPINE-CVE-2023-23936
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVAZL-13604 5.4

CVE-2023-23936 affecting package nodejs for versions less than 16.19.1-1

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect host HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the headers.host string before passing to undici.

Record
AZL-13604
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
Show 25 moreShow less
OSVBELL-CVE-2023-23936 5.4

CVE-2023-23936 does not affect BellSoft software

Record
BELL-CVE-2023-23936
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSV 6.5

CRLF Injection in Nodejs ‘undici’ via host

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect host HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the headers.host string before passing to undici.

Record
CVE-2023-23936
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-93
Updated
2026-11-02
OSVDEBIAN-CVE-2023-23936 5.4

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect host HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the headers.host string before passing to undici.

Record
DEBIAN-CVE-2023-23936
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVGHSA-5r9g-qh6m-jxff 4.6

CRLF Injection in Nodejs ‘undici’ via host

Impact

undici library does not protect host HTTP header from CRLF injection vulnerabilities.

Patches

This issue was patched in Undici v5.19.1.

Workarounds

Sanitize the headers.host string before passing to undici.

References

Reported at https://hackerone.com/reports/1820955.

Credits

Thank you to Zhipeng Zhang (@timon8) for reporting this vulnerability.

Record
GHSA-5r9g-qh6m-jxff
CVSS 3.1
4.6 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-74, CWE-93
Updated
2026-11-02
OSVRHSA-2023:1582 8.6

Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update

Record
RHSA-2023:1582
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2023:1583 7.5

Red Hat Security Advisory: nodejs:18 security, bug fix, and enhancement update

Record
RHSA-2023:1583
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2023:2654 8.6

Red Hat Security Advisory: nodejs:18 security, bug fix, and enhancement update

Record
RHSA-2023:2654
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2023:2655 8.6

Red Hat Security Advisory: nodejs and nodejs-nodemon security, bug fix, and enhancement update

Record
RHSA-2023:2655
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2023:5533 8.8

Red Hat Security Advisory: nodejs security, bug fix, and enhancement update

Record
RHSA-2023:5533
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2023:2654 8.6

Moderate: nodejs:18 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (18.14.2).

Security Fix(es):

  • glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

  • c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

  • http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

  • Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)

  • Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)

  • Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)

  • Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

  • Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2023:2654
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVALSA-2023:1582 No score

Moderate: nodejs:16 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.19.1).

Security Fix(es):

  • glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
  • c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
  • http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
  • Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
  • Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)
  • Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)
  • Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
  • Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:1582
Updated
2026-11-02
OSVALSA-2023:1583 No score

Moderate: nodejs:18 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (18.14.2).

Security Fix(es):

  • glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
  • http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
  • Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
  • Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)
  • Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
  • Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:1583
Updated
2026-11-02
OSVALSA-2023:2654 No score

Moderate: nodejs:18 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (18.14.2).

Security Fix(es):

  • glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
  • c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
  • http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
  • Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
  • Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)
  • Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)
  • Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
  • Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:2654
Updated
2026-11-02
OSVALSA-2023:2655 No score

Moderate: nodejs and nodejs-nodemon security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.19.1), nodejs-nodemon (2.0.20).

Security Fix(es):

  • c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
  • http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
  • Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
  • Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)
  • Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
  • Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:2655
Updated
2026-11-02
OSVBIT-node-2023-23936 No score

CRLF Injection in Nodejs ‘undici’ via host

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect host HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the headers.host string before passing to undici.

Record
BIT-node-2023-23936
Updated
2026-11-02
OSVBIT-node-min-2023-23936 No score

CRLF Injection in Nodejs ‘undici’ via host

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect host HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the headers.host string before passing to undici.

Record
BIT-node-min-2023-23936
Updated
2026-11-02
OSVCLSA-2026-1788560495 No score

TuxCare security update for undici (14 CVEs)

TuxCare rebuilt undici to address 14 CVEs. Fixed in 5.5.1-tuxcare.1.

Record
CLSA-2026-1788560495
Updated
2026-11-02
OSVRLSA-2023:1582 No score

Moderate: nodejs:16 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.19.1).

Security Fix(es):

  • glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

  • c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

  • http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

  • Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)

  • Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)

  • Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)

  • Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

  • Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2023:1582
Updated
2026-11-02
OSVRLSA-2023:1583 No score

Moderate: nodejs:18 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (18.14.2).

Security Fix(es):

  • glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

  • http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

  • Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)

  • Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)

  • Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

  • Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2023:1583
Updated
2026-11-02
OSVRLSA-2023:2655 No score

Moderate: nodejs and nodejs-nodemon security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.19.1), nodejs-nodemon (2.0.20).

Security Fix(es):

  • c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

  • http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

  • Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)

  • Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)

  • Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

  • Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2023:2655
Updated
2026-11-02
OSVSUSE-SU-2023:0608-1 No score

Security update for nodejs16

This update for nodejs16 fixes the following issues:

Update to LTS version 16.19.1:

  • CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule (bsc#1208481).
  • CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library (bsc#1208483).
  • CVE-2023-23920: Fixed insecure loading of ICU data through ICU_DATA environment (bsc#1208487).
  • CVE-2023-23936: Fixed protection against CRLF injection in host headers inside fetch API (bsc#1208485).
  • CVE-2023-24807: Fixed possible Regular Expression Denial of Service (ReDoS) via Headers.set() and Headers.append() methods (bsc#1208413).

Bug fixes:

  • Workaround for failing openssl-nodejs test (bsc#1205568).
Record
SUSE-SU-2023:0608-1
Updated
2026-11-02
OSVSUSE-SU-2023:0609-1 No score

Security update for nodejs16

This update for nodejs16 fixes the following issues:

Update to LTS version 16.19.1:

  • CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule (bsc#1208481).
  • CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library (bsc#1208483).
  • CVE-2023-23920: Fixed insecure loading of ICU data through ICU_DATA environment (bsc#1208487).
  • CVE-2023-23936: Fixed protection against CRLF injection in host headers inside fetch API (bsc#1208485).
  • CVE-2023-24807: Fixed possible Regular Expression Denial of Service (ReDoS) via Headers.set() and Headers.append() methods (bsc#1208413).

Bug fixes:

  • Workaround for failing openssl-nodejs test (bsc#1205568).
Record
SUSE-SU-2023:0609-1
Updated
2026-11-02
OSVSUSE-SU-2023:0673-1 No score

Security update for nodejs16

This update for nodejs16 fixes the following issues:

Update to LTS version 16.19.1:

  • CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule (bsc#1208481).
  • CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library (bsc#1208483).
  • CVE-2023-23920: Fixed insecure loading of ICU data through ICU_DATA environment (bsc#1208487).
  • CVE-2023-23936: Fixed protection against CRLF injection in host headers inside fetch API (bsc#1208485).
  • CVE-2023-24807: Fixed possible Regular Expression Denial of Service (ReDoS) via Headers.set() and Headers.append() methods (bsc#1208413).

Bug fixes:

  • Workaround for failing openssl-nodejs test (bsc#1205568).
Record
SUSE-SU-2023:0673-1
Updated
2026-11-02
OSVSUSE-SU-2023:0715-1 No score

Security update for nodejs18

This update for nodejs18 fixes the following issues:

Update to NodeJS 18.14.2 LTS:

  • CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule (bsc#1208481).
  • CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library (bsc#1208483).
  • CVE-2023-23920: Fixed insecure loading of ICU data through ICU_DATA environment (bsc#1208487).
  • CVE-2023-23936: Fixed protection against CRLF injection in host headers inside fetch API (bsc#1208485).
  • CVE-2023-24807: Fixed possible Regular Expression Denial of Service (ReDoS) via Headers.set() and Headers.append() methods (bsc#1208413).
Record
SUSE-SU-2023:0715-1
Updated
2026-11-02
OSVSUSE-SU-2023:0738-1 No score

Security update for nodejs18

This update for nodejs18 fixes the following issues:

Update to NodeJS 18.14.2 LTS:

  • CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule (bsc#1208481).
  • CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library (bsc#1208483).
  • CVE-2023-23920: Fixed insecure loading of ICU data through ICU_DATA environment (bsc#1208487).
  • CVE-2023-23936: Fixed protection against CRLF injection in host headers inside fetch API (bsc#1208485).
  • CVE-2023-24807: Fixed possible Regular Expression Denial of Service (ReDoS) via Headers.set() and Headers.append() methods (bsc#1208413).
Record
SUSE-SU-2023:0738-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
undici
npm
 2.0.0 up to 5.19.1
5.19.1
nodejs
Alpine:v3.15
 before 16.19.1-r0
16.19.1-r0
nodejs
Alpine:v3.16
 before 16.19.1-r0
16.19.1-r0
nodejs
Alpine:v3.17
 before 18.14.1-r0
18.14.1-r0
nodejs
Alpine:v3.18
 before 18.14.1-r0
18.14.1-r0
nodejs
Alpine:v3.19
 before 18.14.1-r0
18.14.1-r0
nodejs
Alpine:v3.20
 before 18.14.1-r0
18.14.1-r0
nodejs
Alpine:v3.21
 before 18.14.1-r0
18.14.1-r0
nodejs
Alpine:v3.22
 before 18.14.1-r0
18.14.1-r0
nodejs
Alpine:v3.23
 before 18.14.1-r0
18.14.1-r0
Show 106 moreShow less
Affected packages
PackageAffectedFixed
nodejs
Alpine:v3.24
 before 18.14.1-r0
18.14.1-r0
nodejs
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:16.19.1-1.module_el8.7.0+3496+a59a3324
1:16.19.1-1.module_el8.7.0+3496+a59a3324
nodejs-devel
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:16.19.1-1.module_el8.7.0+3496+a59a3324
1:16.19.1-1.module_el8.7.0+3496+a59a3324
nodejs-docs
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:16.19.1-1.module_el8.7.0+3496+a59a3324
1:16.19.1-1.module_el8.7.0+3496+a59a3324
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:16.19.1-1.module_el8.7.0+3496+a59a3324
1:16.19.1-1.module_el8.7.0+3496+a59a3324
nodejs-nodemon
AlmaLinux:8
From an advisory covering 8 CVEs
 before 2.0.20-3.module_el8.7.0+3496+a59a3324
2.0.20-3.module_el8.7.0+3496+a59a3324
nodejs-packaging
AlmaLinux:8
From an advisory covering 8 CVEs
 before 25-1.module_el8.5.0+2605+45d748af
25-1.module_el8.5.0+2605+45d748af
npm
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:8.19.3-1.16.19.1.1.module_el8.7.0+3496+a59a3324
1:8.19.3-1.16.19.1.1.module_el8.7.0+3496+a59a3324
nodejs
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:18.14.2-2.module_el8.7.0+3497+c65299e7
1:18.14.2-2.module_el8.7.0+3497+c65299e7
nodejs-devel
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:18.14.2-2.module_el8.7.0+3497+c65299e7
1:18.14.2-2.module_el8.7.0+3497+c65299e7
nodejs-docs
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:18.14.2-2.module_el8.7.0+3497+c65299e7
1:18.14.2-2.module_el8.7.0+3497+c65299e7
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:18.14.2-2.module_el8.7.0+3497+c65299e7
1:18.14.2-2.module_el8.7.0+3497+c65299e7
nodejs-nodemon
AlmaLinux:8
From an advisory covering 7 CVEs
 before 2.0.20-2.module_el8.7.0+3497+c65299e7
2.0.20-2.module_el8.7.0+3497+c65299e7
nodejs-packaging
AlmaLinux:8
From an advisory covering 7 CVEs
 before 2021.06-4.module_el8.7.0+3343+ea2b7901
2021.06-4.module_el8.7.0+3343+ea2b7901
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 7 CVEs
 before 2021.06-4.module_el8.7.0+3343+ea2b7901
2021.06-4.module_el8.7.0+3343+ea2b7901
npm
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:9.5.0-1.18.14.2.2.module_el8.7.0+3497+c65299e7
1:9.5.0-1.18.14.2.2.module_el8.7.0+3497+c65299e7
nodejs
AlmaLinux:9
From an advisory covering 8 CVEs
 before 1:18.14.2-2.module_el9.2.0+29+de583a0b
1:18.14.2-2.module_el9.2.0+29+de583a0b
nodejs-devel
AlmaLinux:9
From an advisory covering 8 CVEs
 before 1:18.14.2-2.module_el9.2.0+29+de583a0b
1:18.14.2-2.module_el9.2.0+29+de583a0b
nodejs-docs
AlmaLinux:9
From an advisory covering 8 CVEs
 before 1:18.14.2-2.module_el9.2.0+29+de583a0b
1:18.14.2-2.module_el9.2.0+29+de583a0b
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 8 CVEs
 before 1:18.14.2-2.module_el9.2.0+29+de583a0b
1:18.14.2-2.module_el9.2.0+29+de583a0b
nodejs-nodemon
AlmaLinux:9
From an advisory covering 8 CVEs
 before 2.0.20-2.module_el9.2.0+29+de583a0b
2.0.20-2.module_el9.2.0+29+de583a0b
nodejs-packaging
AlmaLinux:9
From an advisory covering 8 CVEs
 before 2021.06-4.module_el9.1.0+13+d9a595ea
2021.06-4.module_el9.1.0+13+d9a595ea
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 8 CVEs
 before 2021.06-4.module_el9.1.0+13+d9a595ea
2021.06-4.module_el9.1.0+13+d9a595ea
npm
AlmaLinux:9
From an advisory covering 8 CVEs
 before 1:9.5.0-1.18.14.2.2.module_el9.2.0+29+de583a0b
1:9.5.0-1.18.14.2.2.module_el9.2.0+29+de583a0b
nodejs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:16.19.1-1.el9_2
1:16.19.1-1.el9_2
nodejs-docs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:16.19.1-1.el9_2
1:16.19.1-1.el9_2
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:16.19.1-1.el9_2
1:16.19.1-1.el9_2
nodejs-libs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:16.19.1-1.el9_2
1:16.19.1-1.el9_2
npm
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:8.19.3-1.16.19.1.1.el9_2
1:8.19.3-1.16.19.1.1.el9_2
nodejs
Azure Linux:2
 before 16.19.1-1
16.19.1-1
node
Bitnami
 16.0.0 up to 16.19.1, 18.0.0 up to 18.14.1, 19.0.0 up to 19.6.1
16.19.118.14.119.6.1
node-min
Bitnami
 16.0.0 up to 16.19.1, 18.0.0 up to 18.14.1, 19.0.0 up to 19.6.1
16.19.118.14.119.6.1
undici
TuxCare:npm
From an advisory covering 14 CVEs
 5.5.1-tuxcare.0 up to 5.5.1-tuxcare.1, plus listed versions
5.5.1
5.5.1-tuxcare.1
node-undici
Debian:12
 before 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1, plus listed versions
5.15.0+dfsg1+~cs20.10.9.3-1
5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1
node-undici
Debian:13
 before 5.19.1+dfsg1+~cs20.10.9.5-1
5.19.1+dfsg1+~cs20.10.9.5-1
node-undici
Debian:14
 before 5.19.1+dfsg1+~cs20.10.9.5-1
5.19.1+dfsg1+~cs20.10.9.5-1
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:16.19.1-1.module+el8.7.0+18373+704f5cef
1:16.19.1-1.module+el8.7.0+18373+704f5cef
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:16.19.1-1.module+el8.7.0+18373+704f5cef
1:16.19.1-1.module+el8.7.0+18373+704f5cef
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:16.19.1-1.module+el8.7.0+18373+704f5cef
1:16.19.1-1.module+el8.7.0+18373+704f5cef
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:16.19.1-1.module+el8.7.0+18373+704f5cef
1:16.19.1-1.module+el8.7.0+18373+704f5cef
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:16.19.1-1.module+el8.7.0+18373+704f5cef
1:16.19.1-1.module+el8.7.0+18373+704f5cef
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:16.19.1-1.module+el8.7.0+18373+704f5cef
1:16.19.1-1.module+el8.7.0+18373+704f5cef
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:2.0.20-3.module+el8.7.0+18373+704f5cef
0:2.0.20-3.module+el8.7.0+18373+704f5cef
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:25-1.module+el8.5.0+10992+fac5fe06
0:25-1.module+el8.5.0+10992+fac5fe06
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef
1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:18.14.2-2.module+el8.7.0+18445+9493b6ea
1:18.14.2-2.module+el8.7.0+18445+9493b6ea
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:18.14.2-2.module+el8.7.0+18445+9493b6ea
1:18.14.2-2.module+el8.7.0+18445+9493b6ea
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:18.14.2-2.module+el8.7.0+18445+9493b6ea
1:18.14.2-2.module+el8.7.0+18445+9493b6ea
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:18.14.2-2.module+el8.7.0+18445+9493b6ea
1:18.14.2-2.module+el8.7.0+18445+9493b6ea
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:18.14.2-2.module+el8.7.0+18445+9493b6ea
1:18.14.2-2.module+el8.7.0+18445+9493b6ea
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:18.14.2-2.module+el8.7.0+18445+9493b6ea
1:18.14.2-2.module+el8.7.0+18445+9493b6ea
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 0:2.0.20-2.module+el8.7.0+18445+9493b6ea
0:2.0.20-2.module+el8.7.0+18445+9493b6ea
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 0:2021.06-4.module+el8.7.0+15582+19c314fa
0:2021.06-4.module+el8.7.0+15582+19c314fa
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 0:2021.06-4.module+el8.7.0+15582+19c314fa
0:2021.06-4.module+el8.7.0+15582+19c314fa
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea
1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 1:18.14.2-2.module+el9.2.0.z+18497+a402347c
1:18.14.2-2.module+el9.2.0.z+18497+a402347c
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 1:18.14.2-2.module+el9.2.0.z+18497+a402347c
1:18.14.2-2.module+el9.2.0.z+18497+a402347c
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 1:18.14.2-2.module+el9.2.0.z+18497+a402347c
1:18.14.2-2.module+el9.2.0.z+18497+a402347c
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 1:18.14.2-2.module+el9.2.0.z+18497+a402347c
1:18.14.2-2.module+el9.2.0.z+18497+a402347c
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 1:18.14.2-2.module+el9.2.0.z+18497+a402347c
1:18.14.2-2.module+el9.2.0.z+18497+a402347c
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 1:18.14.2-2.module+el9.2.0.z+18497+a402347c
1:18.14.2-2.module+el9.2.0.z+18497+a402347c
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:2.0.20-2.module+el9.2.0.z+18497+a402347c
0:2.0.20-2.module+el9.2.0.z+18497+a402347c
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:2021.06-4.module+el9.1.0+15718+e52ec601
0:2021.06-4.module+el9.1.0+15718+e52ec601
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:2021.06-4.module+el9.1.0+15718+e52ec601
0:2021.06-4.module+el9.1.0+15718+e52ec601
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c
1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:16.19.1-1.el9_2
1:16.19.1-1.el9_2
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:16.19.1-1.el9_2
1:16.19.1-1.el9_2
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:16.19.1-1.el9_2
1:16.19.1-1.el9_2
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:16.19.1-1.el9_2
1:16.19.1-1.el9_2
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:16.19.1-1.el9_2
1:16.19.1-1.el9_2
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:16.19.1-1.el9_2
1:16.19.1-1.el9_2
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:16.19.1-1.el9_2
1:16.19.1-1.el9_2
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:2.0.20-3.el9_2
0:2.0.20-3.el9_2
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:8.19.3-1.16.19.1.1.el9_2
1:8.19.3-1.16.19.1.1.el9_2
nodejs
Red Hat:rhel_eus:9.0::appstream
From an advisory covering 12 CVEs
 before 1:16.20.2-1.el9_0
1:16.20.2-1.el9_0
nodejs-debuginfo
Red Hat:rhel_eus:9.0::appstream
From an advisory covering 12 CVEs
 before 1:16.20.2-1.el9_0
1:16.20.2-1.el9_0
nodejs-debugsource
Red Hat:rhel_eus:9.0::appstream
From an advisory covering 12 CVEs
 before 1:16.20.2-1.el9_0
1:16.20.2-1.el9_0
nodejs-docs
Red Hat:rhel_eus:9.0::appstream
From an advisory covering 12 CVEs
 before 1:16.20.2-1.el9_0
1:16.20.2-1.el9_0
nodejs-full-i18n
Red Hat:rhel_eus:9.0::appstream
From an advisory covering 12 CVEs
 before 1:16.20.2-1.el9_0
1:16.20.2-1.el9_0
nodejs-libs
Red Hat:rhel_eus:9.0::appstream
From an advisory covering 12 CVEs
 before 1:16.20.2-1.el9_0
1:16.20.2-1.el9_0
nodejs-libs-debuginfo
Red Hat:rhel_eus:9.0::appstream
From an advisory covering 12 CVEs
 before 1:16.20.2-1.el9_0
1:16.20.2-1.el9_0
npm
Red Hat:rhel_eus:9.0::appstream
From an advisory covering 12 CVEs
 before 1:8.19.4-1.16.20.2.1.el9_0
1:8.19.4-1.16.20.2.1.el9_0
nodejs
Rocky Linux:8
From an advisory covering 8 CVEs
 before 1:16.19.1-1.module+el8.7.0+1178+d52dba78
1:16.19.1-1.module+el8.7.0+1178+d52dba78
nodejs-nodemon
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:2.0.20-3.module+el8.7.0+1178+d52dba78
0:2.0.20-3.module+el8.7.0+1178+d52dba78
nodejs-packaging
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:25-1.module+el8.6.0+1046+80feca58
0:25-1.module+el8.6.0+1046+80feca58
nodejs
Rocky Linux:8
From an advisory covering 6 CVEs
 before 1:18.14.2-2.module+el8.7.0+1177+510ae886
1:18.14.2-2.module+el8.7.0+1177+510ae886
nodejs-nodemon
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:2.0.20-2.module+el8.7.0+1108+49363b0d
0:2.0.20-2.module+el8.7.0+1108+49363b0d
nodejs-packaging
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:2021.06-4.module+el8.7.0+1072+5b168780
0:2021.06-4.module+el8.7.0+1072+5b168780
nodejs-packaging
Rocky Linux:9
From an advisory covering 8 CVEs
 before 0:2021.06-4.module+el9.7.0+40025+0e0cf6b2
0:2021.06-4.module+el9.7.0+40025+0e0cf6b2
nodejs-packaging
Rocky Linux:9
From an advisory covering 8 CVEs
 before 0:2021.06-4.module+el9.7.0+40017+f0db1785
0:2021.06-4.module+el9.7.0+40017+f0db1785
nodejs-packaging
Rocky Linux:9
From an advisory covering 8 CVEs
 before 0:2021.06-4.module+el9.7.0+40018+a011993d
0:2021.06-4.module+el9.7.0+40018+a011993d
nodejs-packaging
Rocky Linux:9
From an advisory covering 8 CVEs
 before 0:2021.06-4.module+el9.7.0+40022+9ecc286c
0:2021.06-4.module+el9.7.0+40022+9ecc286c
nodejs
Rocky Linux:9
From an advisory covering 6 CVEs
 before 1:16.19.1-1.el9_2
1:16.19.1-1.el9_2
nodejs-nodemon
Rocky Linux:9
From an advisory covering 6 CVEs
 before 0:2.0.20-3.el9_2
0:2.0.20-3.el9_2
nodejs16
SUSE:Linux Enterprise Module for Web and Scripting 15 SP4
From an advisory covering 5 CVEs
 before 16.19.1-150400.3.15.1
16.19.1-150400.3.15.1
nodejs16
openSUSE:Leap 15.4
From an advisory covering 5 CVEs
 before 16.19.1-150400.3.15.1
16.19.1-150400.3.15.1
nodejs16
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 5 CVEs
 before 16.19.1-8.24.1
16.19.1-8.24.1
nodejs16
SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS
From an advisory covering 5 CVEs
 before 16.19.1-150300.7.18.1
16.19.1-150300.7.18.1
nodejs16
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
From an advisory covering 5 CVEs
 before 16.19.1-150300.7.18.1
16.19.1-150300.7.18.1
nodejs16
SUSE:Linux Enterprise Server 15 SP3-LTSS
From an advisory covering 5 CVEs
 before 16.19.1-150300.7.18.1
16.19.1-150300.7.18.1
nodejs16
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
From an advisory covering 5 CVEs
 before 16.19.1-150300.7.18.1
16.19.1-150300.7.18.1
nodejs16
SUSE:Manager Server 4.2
From an advisory covering 5 CVEs
 before 16.19.1-150300.7.18.1
16.19.1-150300.7.18.1
nodejs16
SUSE:Enterprise Storage 7.1
From an advisory covering 5 CVEs
 before 16.19.1-150300.7.18.1
16.19.1-150300.7.18.1
nodejs18
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 5 CVEs
 before 18.14.2-8.6.2
18.14.2-8.6.2
nodejs18
SUSE:Linux Enterprise Module for Web and Scripting 15 SP4
From an advisory covering 5 CVEs
 before 18.14.2-150400.9.6.2
18.14.2-150400.9.6.2
nodejs18
openSUSE:Leap 15.4
From an advisory covering 5 CVEs
 before 18.14.2-150400.9.6.2
18.14.2-150400.9.6.2

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-23936 is a medium vulnerability (CVSS 6.5) in Nodejs Node.js, published February 16, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.13%, the 66th percentile. Fixed in undici 5.19.1.

References

Show 119 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open