{"id":"CVE-2023-23936","aliases":["ALPINE-CVE-2023-23936","ALSA-2023:1582","ALSA-2023:1583","ALSA-2023:2654","ALSA-2023:2655","AZL-13604","BELL-CVE-2023-23936","BIT-node-2023-23936","BIT-node-min-2023-23936","CLSA-2026-1788560495","DEBIAN-CVE-2023-23936","EUVD-2023-0633","GHSA-5r9g-qh6m-jxff","RHSA-2023:1582","RHSA-2023:1583","RHSA-2023:2654","RHSA-2023:2655","RHSA-2023:5533","RLSA-2023:1582","RLSA-2023:1583","RLSA-2023:2654","RLSA-2023:2655","SUSE-SU-2023:0608-1","SUSE-SU-2023:0609-1","SUSE-SU-2023:0673-1","SUSE-SU-2023:0715-1","SUSE-SU-2023:0738-1"],"status":"published","title":"CRLF Injection in Nodejs ‘undici’ via host","description":"Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01129,"percentile":0.6661,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74","CWE-93"],"published":"2023-02-16T17:30:23Z","modified":"2026-10-29T11:31:26Z","fixes":[{"ecosystem":"npm","package":"undici","fixed_in":["5.19.1"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.15","package":"nodejs","fixed_in":["16.19.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"nodejs","fixed_in":["16.19.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"nodejs","fixed_in":["18.14.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"nodejs","fixed_in":["18.14.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nodejs","fixed_in":["18.14.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nodejs","fixed_in":["18.14.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs","fixed_in":["18.14.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs","fixed_in":["18.14.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs","fixed_in":["18.14.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs","fixed_in":["18.14.1-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"nodejs","fixed_in":["16.19.1-1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node","fixed_in":["16.19.1","18.14.1","19.6.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["16.19.1","18.14.1","19.6.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-undici","fixed_in":["5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-undici","fixed_in":["5.19.1+dfsg1+~cs20.10.9.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-undici","fixed_in":["5.19.1+dfsg1+~cs20.10.9.5-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"5.19.1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.19.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.19.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.14.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.14.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.14.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.14.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.14.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.14.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.14.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.14.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.module_el8.7.0+3496+a59a3324"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.module_el8.7.0+3496+a59a3324"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.module_el8.7.0+3496+a59a3324"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.module_el8.7.0+3496+a59a3324"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.20-3.module_el8.7.0+3496+a59a3324"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25-1.module_el8.5.0+2605+45d748af"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.3-1.16.19.1.1.module_el8.7.0+3496+a59a3324"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module_el8.7.0+3497+c65299e7"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module_el8.7.0+3497+c65299e7"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module_el8.7.0+3497+c65299e7"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module_el8.7.0+3497+c65299e7"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.20-2.module_el8.7.0+3497+c65299e7"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.7.0+3343+ea2b7901"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.7.0+3343+ea2b7901"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.5.0-1.18.14.2.2.module_el8.7.0+3497+c65299e7"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module_el9.2.0+29+de583a0b"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module_el9.2.0+29+de583a0b"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module_el9.2.0+29+de583a0b"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module_el9.2.0+29+de583a0b"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.20-2.module_el9.2.0+29+de583a0b"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.1.0+13+d9a595ea"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.1.0+13+d9a595ea"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.5.0-1.18.14.2.2.module_el9.2.0+29+de583a0b"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.el9_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.el9_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.el9_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.el9_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.3-1.16.19.1.1.el9_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Azure Linux:2","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.19.1-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0"},{"fixed":"16.19.1"},{"introduced":"18.0.0"},{"fixed":"18.14.1"},{"introduced":"19.0.0"},{"fixed":"19.6.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0"},{"fixed":"16.19.1"},{"introduced":"18.0.0"},{"fixed":"18.14.1"},{"introduced":"19.0.0"},{"fixed":"19.6.1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.1-tuxcare.0"},{"fixed":"5.5.1-tuxcare.1"}]}],"versions":["5.5.1"],"bundled":14},{"source":"osv","ecosystem":"Debian:12","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1"}]}],"versions":["5.15.0+dfsg1+~cs20.10.9.3-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.19.1+dfsg1+~cs20.10.9.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.19.1+dfsg1+~cs20.10.9.5-1"}]}]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"5.19.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.module+el8.7.0+18373+704f5cef"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.module+el8.7.0+18373+704f5cef"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.module+el8.7.0+18373+704f5cef"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.module+el8.7.0+18373+704f5cef"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.module+el8.7.0+18373+704f5cef"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.module+el8.7.0+18373+704f5cef"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-3.module+el8.7.0+18373+704f5cef"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25-1.module+el8.5.0+10992+fac5fe06"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module+el8.7.0+18445+9493b6ea"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module+el8.7.0+18445+9493b6ea"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module+el8.7.0+18445+9493b6ea"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module+el8.7.0+18445+9493b6ea"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module+el8.7.0+18445+9493b6ea"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module+el8.7.0+18445+9493b6ea"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-2.module+el8.7.0+18445+9493b6ea"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.7.0+15582+19c314fa"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.7.0+15582+19c314fa"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module+el9.2.0.z+18497+a402347c"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module+el9.2.0.z+18497+a402347c"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module+el9.2.0.z+18497+a402347c"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module+el9.2.0.z+18497+a402347c"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module+el9.2.0.z+18497+a402347c"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module+el9.2.0.z+18497+a402347c"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-2.module+el9.2.0.z+18497+a402347c"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.1.0+15718+e52ec601"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.1.0+15718+e52ec601"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.el9_2"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.el9_2"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.el9_2"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.el9_2"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.el9_2"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.el9_2"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.el9_2"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-3.el9_2"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.3-1.16.19.1.1.el9_2"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-1.el9_0"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-1.el9_0"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-1.el9_0"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-1.el9_0"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-1.el9_0"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-1.el9_0"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-1.el9_0"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.4-1.16.20.2.1.el9_0"}]}],"bundled":12},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.module+el8.7.0+1178+d52dba78"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-3.module+el8.7.0+1178+d52dba78"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25-1.module+el8.6.0+1046+80feca58"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module+el8.7.0+1177+510ae886"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-2.module+el8.7.0+1108+49363b0d"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.7.0+1072+5b168780"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.7.0+40025+0e0cf6b2"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.7.0+40017+f0db1785"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.7.0+40018+a011993d"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.7.0+40022+9ecc286c"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.el9_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-3.el9_2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP4","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.19.1-150400.3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.19.1-150400.3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.19.1-8.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.19.1-150300.7.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.19.1-150300.7.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.19.1-150300.7.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.19.1-150300.7.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.19.1-150300.7.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.19.1-150300.7.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.14.2-8.6.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP4","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.14.2-150400.9.6.2"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.14.2-150400.9.6.2"}]}],"bundled":5}],"products":[{"vendor":"nodejs","product":"node.js"},{"vendor":"nodejs","product":"undici"},{"vendor":"undici","product":"undici"}],"references":[{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxff","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/nodejs/undici/commit/a2eff05401358f6595138df963837c24348f2034","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://hackerone.com/reports/1820955","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","advisory","web"]},{"url":"https://github.com/nodejs/undici/releases/tag/v5.19.1","tags":["x_refsource_MISC","x_transferred","Release Notes","article","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23936","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-5r9g-qh6m-jxff"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-23936","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1582","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-35065","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25881","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-4904","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-23918","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-23919","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-23920","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-23936","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24807","tags":["report"]},{"url":"https://bugzilla.redhat.com/2156324","tags":["report"]},{"url":"https://bugzilla.redhat.com/2165824","tags":["report"]},{"url":"https://bugzilla.redhat.com/2168631","tags":["report"]},{"url":"https://bugzilla.redhat.com/2171935","tags":["report"]},{"url":"https://bugzilla.redhat.com/2172170","tags":["report"]},{"url":"https://bugzilla.redhat.com/2172190","tags":["report"]},{"url":"https://bugzilla.redhat.com/2172204","tags":["report"]},{"url":"https://bugzilla.redhat.com/2172217","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-1582.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1583","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/2178087","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-1583.html","tags":["advisory"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2023-23919.html","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2023:2654","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-2654.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:2655","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-2655.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-23936","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23936.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-23936","tags":["advisory"]},{"url":"https://github.com/nodejs/undici","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2156324","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2165824","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2168631","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2171935","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172170","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172190","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172204","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172217","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2178142","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1582.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-35065","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35065","tags":["advisory"]},{"url":"https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-4904","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4904","tags":["advisory"]},{"url":"https://github.com/c-ares/c-ares/issues/496","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25881","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25881","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-23918","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23918","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-23919","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23919","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-23920","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23920","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-23936","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24807","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24807","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2178087","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1583.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2178088","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2654.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2178076","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2655.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5533","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2178078","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2219824","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2219838","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2219841","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2219842","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2223335","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2230948","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2230955","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2230956","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236435","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5533.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-30581","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-30581","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30581","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-30588","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-30588","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30588","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-30589","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-30589","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30589","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-30590","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-30590","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30590","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-32002","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-32002","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32002","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-be-bypassed-via-module_load-highcve-2023-32002","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-32006","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-32006","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32006","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-impersonate-other-modules-in-using-moduleconstructorcreaterequire-mediumcve-2023-32006","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-32559","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-32559","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32559","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-be-bypassed-via-processbinding-mediumcve-2023-32559","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2023:1582","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:1583","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:2654","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:2655","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230608-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1205568","tags":["report"]},{"url":"https://bugzilla.suse.com/1208413","tags":["report"]},{"url":"https://bugzilla.suse.com/1208481","tags":["report"]},{"url":"https://bugzilla.suse.com/1208483","tags":["report"]},{"url":"https://bugzilla.suse.com/1208485","tags":["report"]},{"url":"https://bugzilla.suse.com/1208487","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-23918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-23919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-23920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-23936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24807","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230609-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230673-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230715-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230738-1/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-23936","title":"CRLF Injection in Nodejs ‘undici’ via host","description":"Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.","status":"published","published":"2023-02-16T17:30:23.968Z","modified":"2025-03-10T21:10:26.495Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:35:20.812737Z"}],"euvd":[{"id":"EUVD-2023-0633","description":"Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.","status":"published","published":"2023-02-16T17:30:23Z","modified":"2025-03-10T21:10:26Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:53:09.197707Z"}],"ghsa":[{"id":"GHSA-5r9g-qh6m-jxff","title":"CRLF Injection in Nodejs ‘undici’ via host","description":"### Impact\n\nundici library does not protect `host` HTTP header from CRLF injection vulnerabilities.\n\n### Patches\n\nThis issue was patched in Undici v5.19.1.\n\n### Workarounds\n\nSanitize the `headers.host` string before passing to undici.\n\n### References\n\nReported at https://hackerone.com/reports/1820955.\n\n### Credits\n\nThank you to Zhipeng Zhang ([@timon8](https://hackerone.com/timon8)) for reporting this vulnerability. ","status":"published","published":"2023-02-16T20:46:30Z","modified":"2023-02-24T21:40:36Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-74","CWE-93"],"updated_at":"2026-11-02T14:36:46.526285Z"}],"nvd":[{"id":"CVE-2023-23936","description":"Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.","status":"published","published":"2023-02-16T18:15:10.877Z","modified":"2026-06-17T05:38:19.6Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-93","CWE-74"],"updated_at":"2026-11-02T14:07:46.811196Z"}],"osv":[{"id":"ALPINE-CVE-2023-23936","description":"Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.","status":"published","published":"2023-02-16T18:15:10.877Z","modified":"2026-10-26T17:17:58.611041351Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:49.202584Z"},{"id":"AZL-13604","title":"CVE-2023-23936 affecting package nodejs for versions less than 16.19.1-1","description":"Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.","status":"published","published":"2023-02-16T18:15:10Z","modified":"2026-04-21T04:22:55.861267Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"BELL-CVE-2023-23936","title":"CVE-2023-23936 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:22.64938Z","modified":"2026-02-18T07:38:27.555313Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"CVE-2023-23936","title":"CRLF Injection in Nodejs ‘undici’ via host","description":"Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.","status":"published","published":"2023-02-16T17:30:23.968Z","modified":"2026-10-28T02:30:59.649189973Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T15:44:30.709518Z"},{"id":"DEBIAN-CVE-2023-23936","description":"Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.","status":"published","published":"2023-02-16T18:15:10.877Z","modified":"2026-10-26T18:00:33.383644034Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"GHSA-5r9g-qh6m-jxff","title":"CRLF Injection in Nodejs ‘undici’ via host","description":"### Impact\n\nundici library does not protect `host` HTTP header from CRLF injection vulnerabilities.\n\n### Patches\n\nThis issue was patched in Undici v5.19.1.\n\n### Workarounds\n\nSanitize the `headers.host` string before passing to undici.\n\n### References\n\nReported at https://hackerone.com/reports/1820955.\n\n### Credits\n\nThank you to Zhipeng Zhang ([@timon8](https://hackerone.com/timon8)) for reporting this vulnerability. ","status":"published","published":"2023-02-16T20:46:30Z","modified":"2026-09-10T03:49:51.840716639Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-74","CWE-93"],"updated_at":"2026-11-02T15:46:38.911014Z"},{"id":"RHSA-2023:1582","title":"Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update","status":"published","published":"2024-10-22T00:35:12Z","modified":"2026-10-13T10:04:01Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1583","title":"Red Hat Security Advisory: nodejs:18 security, bug fix, and enhancement update","status":"published","published":"2024-10-22T00:35:24Z","modified":"2026-10-13T10:04:01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:2654","title":"Red Hat Security Advisory: nodejs:18 security, bug fix, and enhancement update","status":"published","published":"2024-10-22T00:36:26Z","modified":"2026-10-13T10:04:11Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:2655","title":"Red Hat Security Advisory: nodejs and nodejs-nodemon security, bug fix, and enhancement update","status":"published","published":"2024-09-29T23:58:08Z","modified":"2026-10-13T10:04:11Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:5533","title":"Red Hat Security Advisory: nodejs security, bug fix, and enhancement update","status":"published","published":"2024-09-29T23:58:35Z","modified":"2026-10-09T10:07:02Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RLSA-2023:2654","title":"Moderate: nodejs:18 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (18.14.2).\n\nSecurity Fix(es):\n\n* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n\n* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)\n\n* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)\n\n* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)\n\n* Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)\n\n* Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)\n\n* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)\n\n* Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-12-03T09:05:37.576021Z","modified":"2025-12-03T11:33:54.009749Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"ALSA-2023:1582","title":"Moderate: nodejs:16 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (16.19.1).\n\nSecurity Fix(es):\n\n* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)\n* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)\n* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)\n* Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)\n* Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)\n* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)\n* Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-04-04T00:00:00Z","modified":"2026-10-29T11:02:03.175038174Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2023:1583","title":"Moderate: nodejs:18 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (18.14.2).\n\nSecurity Fix(es):\n\n* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)\n* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)\n* Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)\n* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)\n* Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-04-04T00:00:00Z","modified":"2026-10-29T11:12:06.044141041Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2023:2654","title":"Moderate: nodejs:18 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (18.14.2).\n\nSecurity Fix(es):\n\n* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)\n* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)\n* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)\n* Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)\n* Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)\n* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)\n* Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-05-09T00:00:00Z","modified":"2026-10-29T11:31:26.123864832Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2023:2655","title":"Moderate: nodejs and nodejs-nodemon security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (16.19.1), nodejs-nodemon (2.0.20).\n\nSecurity Fix(es):\n\n* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)\n* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)\n* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)\n* Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)\n* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)\n* Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-05-09T00:00:00Z","modified":"2026-10-29T11:31:24.996241146Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"BIT-node-2023-23936","title":"CRLF Injection in Nodejs ‘undici’ via host","description":"Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.","status":"published","published":"2024-03-06T11:01:51.693Z","modified":"2026-09-08T08:48:17.742732164Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-node-min-2023-23936","title":"CRLF Injection in Nodejs ‘undici’ via host","description":"Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.","status":"published","published":"2024-12-16T14:00:12.823Z","modified":"2026-09-08T08:48:17.466012182Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"CLSA-2026-1788560495","title":"TuxCare security update for undici (14 CVEs)","description":"TuxCare rebuilt undici to address 14 CVEs. Fixed in 5.5.1-tuxcare.1.","status":"published","published":"2026-09-04T22:21:35Z","modified":"2026-10-15T09:48:03.135244229Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"RLSA-2023:1582","title":"Moderate: nodejs:16 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (16.19.1).\n\nSecurity Fix(es):\n\n* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n\n* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)\n\n* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)\n\n* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)\n\n* Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)\n\n* Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)\n\n* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)\n\n* Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-04-06T15:52:43.18089Z","modified":"2026-02-05T12:15:07.041362Z","updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"RLSA-2023:1583","title":"Moderate: nodejs:18 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (18.14.2).\n\nSecurity Fix(es):\n\n* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n\n* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)\n\n* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)\n\n* Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)\n\n* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)\n\n* Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-04-06T15:52:43.18089Z","modified":"2026-02-04T23:45:04.622287Z","updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"RLSA-2023:2655","title":"Moderate: nodejs and nodejs-nodemon security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (16.19.1), nodejs-nodemon (2.0.20).\n\nSecurity Fix(es):\n\n* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)\n\n* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)\n\n* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)\n\n* Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)\n\n* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)\n\n* Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-05-25T19:53:09.847906Z","modified":"2026-02-04T07:40:22.276968Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"SUSE-SU-2023:0608-1","title":"Security update for nodejs16","description":"This update for nodejs16 fixes the following issues:\n\nUpdate to LTS version 16.19.1:\n\n- CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule (bsc#1208481).\n- CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library (bsc#1208483).\n- CVE-2023-23920: Fixed insecure loading of ICU data through ICU_DATA environment (bsc#1208487).\n- CVE-2023-23936: Fixed protection against CRLF injection in host headers inside fetch API (bsc#1208485).\n- CVE-2023-24807: Fixed possible Regular Expression Denial of Service (ReDoS) via Headers.set() and Headers.append() methods (bsc#1208413).\n\nBug fixes:\n\n- Workaround for failing openssl-nodejs test (bsc#1205568).\n","status":"published","published":"2023-03-03T11:03:33Z","modified":"2026-02-04T02:42:30.823353Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:0609-1","title":"Security update for nodejs16","description":"This update for nodejs16 fixes the following issues:\n\nUpdate to LTS version 16.19.1:\n\n- CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule (bsc#1208481).\n- CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library (bsc#1208483).\n- CVE-2023-23920: Fixed insecure loading of ICU data through ICU_DATA environment (bsc#1208487).\n- CVE-2023-23936: Fixed protection against CRLF injection in host headers inside fetch API (bsc#1208485).\n- CVE-2023-24807: Fixed possible Regular Expression Denial of Service (ReDoS) via Headers.set() and Headers.append() methods (bsc#1208413).\n\nBug fixes:\n\n- Workaround for failing openssl-nodejs test (bsc#1205568).\n","status":"published","published":"2023-03-03T11:03:51Z","modified":"2026-02-04T03:51:03.63113Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:0673-1","title":"Security update for nodejs16","description":"This update for nodejs16 fixes the following issues:\n\nUpdate to LTS version 16.19.1:\n\n- CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule (bsc#1208481).\n- CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library (bsc#1208483).\n- CVE-2023-23920: Fixed insecure loading of ICU data through ICU_DATA environment (bsc#1208487).\n- CVE-2023-23936: Fixed protection against CRLF injection in host headers inside fetch API (bsc#1208485).\n- CVE-2023-24807: Fixed possible Regular Expression Denial of Service (ReDoS) via Headers.set() and Headers.append() methods (bsc#1208413).\n\nBug fixes:\n\n- Workaround for failing openssl-nodejs test (bsc#1205568).\n","status":"published","published":"2023-03-08T13:28:14Z","modified":"2025-05-02T04:34:37.832024Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:0715-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n  \nUpdate to NodeJS 18.14.2 LTS:\n\n- CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule (bsc#1208481).\n- CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library (bsc#1208483).\n- CVE-2023-23920: Fixed insecure loading of ICU data through ICU_DATA environment (bsc#1208487).\n- CVE-2023-23936: Fixed protection against CRLF injection in host headers inside fetch API (bsc#1208485).\n- CVE-2023-24807: Fixed possible Regular Expression Denial of Service (ReDoS) via Headers.set() and Headers.append() methods (bsc#1208413).\n","status":"published","published":"2023-03-13T09:58:51Z","modified":"2026-02-04T03:32:06.633419Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:0738-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\nUpdate to NodeJS 18.14.2 LTS:\n\n- CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule (bsc#1208481).\n- CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library (bsc#1208483).\n- CVE-2023-23920: Fixed insecure loading of ICU data through ICU_DATA environment (bsc#1208487).\n- CVE-2023-23936: Fixed protection against CRLF injection in host headers inside fetch API (bsc#1208485).\n- CVE-2023-24807: Fixed possible Regular Expression Denial of Service (ReDoS) via Headers.set() and Headers.append() methods (bsc#1208413).\n","status":"published","published":"2023-03-15T07:17:55Z","modified":"2026-02-04T03:50:14.024459Z","updated_at":"2026-11-02T15:53:52.350754Z"}]}}