{"id":"CVE-2023-24807","aliases":["ALPINE-CVE-2023-24807","ALSA-2023:1582","ALSA-2023:1583","ALSA-2023:2654","ALSA-2023:2655","AZL-13585","BELL-CVE-2023-24807","CLSA-2026-1788560495","DEBIAN-CVE-2023-24807","EUVD-2023-0786","GHSA-r6ch-mqf9-qc9w","RHSA-2023:1582","RHSA-2023:1583","RHSA-2023:2654","RHSA-2023:2655","RHSA-2023:5533","RLSA-2023:1582","RLSA-2023:1583","RLSA-2023:2654","RLSA-2023:2655","SUSE-SU-2023:0608-1","SUSE-SU-2023:0609-1","SUSE-SU-2023:0673-1","SUSE-SU-2023:0715-1","SUSE-SU-2023:0738-1","openSUSE-SU-2024:12725-1","openSUSE-SU-2024:12726-1"],"status":"published","title":"Undici vulnerable to Regular Expression Denial of Service in Headers","description":"Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01315,"percentile":0.71128,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333","CWE-20"],"published":"2023-02-16T17:30:19Z","modified":"2026-10-29T11:31:26Z","fixes":[{"ecosystem":"npm","package":"undici","fixed_in":["5.19.1"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.15","package":"nodejs","fixed_in":["16.19.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"nodejs","fixed_in":["16.19.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"nodejs","fixed_in":["18.14.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"nodejs","fixed_in":["18.14.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nodejs","fixed_in":["18.14.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nodejs","fixed_in":["18.14.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs","fixed_in":["18.14.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs","fixed_in":["18.14.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs","fixed_in":["18.14.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs","fixed_in":["18.14.1-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"nodejs","fixed_in":["16.19.1-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-undici","fixed_in":["5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-undici","fixed_in":["5.19.1+dfsg1+~cs20.10.9.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-undici","fixed_in":["5.19.1+dfsg1+~cs20.10.9.5-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.19.1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.19.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.19.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.14.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.14.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.14.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.14.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.14.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.14.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.14.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.14.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.module_el8.7.0+3496+a59a3324"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.module_el8.7.0+3496+a59a3324"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.module_el8.7.0+3496+a59a3324"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.module_el8.7.0+3496+a59a3324"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.20-3.module_el8.7.0+3496+a59a3324"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25-1.module_el8.5.0+2605+45d748af"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.3-1.16.19.1.1.module_el8.7.0+3496+a59a3324"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module_el8.7.0+3497+c65299e7"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module_el8.7.0+3497+c65299e7"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module_el8.7.0+3497+c65299e7"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module_el8.7.0+3497+c65299e7"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.20-2.module_el8.7.0+3497+c65299e7"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.7.0+3343+ea2b7901"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.7.0+3343+ea2b7901"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.5.0-1.18.14.2.2.module_el8.7.0+3497+c65299e7"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module_el9.2.0+29+de583a0b"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module_el9.2.0+29+de583a0b"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module_el9.2.0+29+de583a0b"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module_el9.2.0+29+de583a0b"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.20-2.module_el9.2.0+29+de583a0b"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.1.0+13+d9a595ea"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.1.0+13+d9a595ea"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.5.0-1.18.14.2.2.module_el9.2.0+29+de583a0b"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.el9_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.el9_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.el9_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.el9_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.3-1.16.19.1.1.el9_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Azure Linux:2","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.19.1-1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.1-tuxcare.0"},{"fixed":"5.5.1-tuxcare.1"}]}],"versions":["5.5.1"],"bundled":14},{"source":"osv","ecosystem":"Debian:12","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1"}]}],"versions":["5.15.0+dfsg1+~cs20.10.9.3-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.19.1+dfsg1+~cs20.10.9.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.19.1+dfsg1+~cs20.10.9.5-1"}]}]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.19.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.module+el8.7.0+18373+704f5cef"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.module+el8.7.0+18373+704f5cef"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.module+el8.7.0+18373+704f5cef"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.module+el8.7.0+18373+704f5cef"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.module+el8.7.0+18373+704f5cef"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.module+el8.7.0+18373+704f5cef"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-3.module+el8.7.0+18373+704f5cef"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25-1.module+el8.5.0+10992+fac5fe06"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module+el8.7.0+18445+9493b6ea"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module+el8.7.0+18445+9493b6ea"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module+el8.7.0+18445+9493b6ea"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module+el8.7.0+18445+9493b6ea"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module+el8.7.0+18445+9493b6ea"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module+el8.7.0+18445+9493b6ea"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-2.module+el8.7.0+18445+9493b6ea"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.7.0+15582+19c314fa"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.7.0+15582+19c314fa"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module+el9.2.0.z+18497+a402347c"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module+el9.2.0.z+18497+a402347c"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module+el9.2.0.z+18497+a402347c"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module+el9.2.0.z+18497+a402347c"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module+el9.2.0.z+18497+a402347c"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module+el9.2.0.z+18497+a402347c"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-2.module+el9.2.0.z+18497+a402347c"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.1.0+15718+e52ec601"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.1.0+15718+e52ec601"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.el9_2"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.el9_2"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.el9_2"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.el9_2"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.el9_2"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.el9_2"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.el9_2"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-3.el9_2"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.3-1.16.19.1.1.el9_2"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-1.el9_0"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-1.el9_0"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-1.el9_0"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-1.el9_0"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-1.el9_0"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-1.el9_0"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-1.el9_0"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.4-1.16.20.2.1.el9_0"}]}],"bundled":12},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.module+el8.7.0+1178+d52dba78"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-3.module+el8.7.0+1178+d52dba78"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25-1.module+el8.6.0+1046+80feca58"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.14.2-2.module+el8.7.0+1177+510ae886"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-2.module+el8.7.0+1108+49363b0d"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.7.0+1072+5b168780"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.7.0+40025+0e0cf6b2"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.7.0+40017+f0db1785"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.7.0+40018+a011993d"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.7.0+40022+9ecc286c"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.19.1-1.el9_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-3.el9_2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP4","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.19.1-150400.3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.19.1-150400.3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.19.1-8.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.19.1-150300.7.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.19.1-150300.7.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.19.1-150300.7.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.19.1-150300.7.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.19.1-150300.7.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.19.1-150300.7.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.14.2-8.6.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP4","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.14.2-150400.9.6.2"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.14.2-150400.9.6.2"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.14.2-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.7.0-1.1"}]}],"bundled":4}],"products":[{"vendor":"nodejs","product":"undici"},{"vendor":"undici","product":"undici"}],"references":[{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/nodejs/undici/commit/f2324e549943f0b0937b09fb1c0c16cc7c93abdf","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/nodejs/undici/releases/tag/v5.19.1","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://hackerone.com/bugs?report_id=1784449","tags":["x_refsource_MISC","x_transferred","Permissions Required","Third Party Advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20230324-0010/","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24807","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-r6ch-mqf9-qc9w"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-24807","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1582","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-35065","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25881","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-4904","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-23918","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-23919","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-23920","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-23936","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24807","tags":["report"]},{"url":"https://bugzilla.redhat.com/2156324","tags":["report"]},{"url":"https://bugzilla.redhat.com/2165824","tags":["report"]},{"url":"https://bugzilla.redhat.com/2168631","tags":["report"]},{"url":"https://bugzilla.redhat.com/2171935","tags":["report"]},{"url":"https://bugzilla.redhat.com/2172170","tags":["report"]},{"url":"https://bugzilla.redhat.com/2172190","tags":["report"]},{"url":"https://bugzilla.redhat.com/2172204","tags":["report"]},{"url":"https://bugzilla.redhat.com/2172217","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-1582.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1583","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/2178087","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-1583.html","tags":["advisory"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2023-23919.html","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2023:2654","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-2654.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:2655","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-2655.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-24807","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24807.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-24807","tags":["advisory"]},{"url":"https://github.com/nodejs/undici","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2156324","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2165824","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2168631","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2171935","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172170","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172190","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172204","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172217","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2178142","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1582.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-35065","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35065","tags":["advisory"]},{"url":"https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-4904","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4904","tags":["advisory"]},{"url":"https://github.com/c-ares/c-ares/issues/496","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25881","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25881","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-23918","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23918","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-23919","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23919","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-23920","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23920","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-23936","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23936","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24807","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2178087","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1583.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2178088","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2654.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2178076","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2655.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5533","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2178078","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2219824","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2219838","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2219841","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2219842","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2223335","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2230948","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2230955","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2230956","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236435","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5533.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-30581","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-30581","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30581","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-30588","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-30588","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30588","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-30589","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-30589","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30589","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-30590","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-30590","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30590","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-32002","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-32002","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32002","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-be-bypassed-via-module_load-highcve-2023-32002","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-32006","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-32006","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32006","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-impersonate-other-modules-in-using-moduleconstructorcreaterequire-mediumcve-2023-32006","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-32559","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-32559","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32559","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-be-bypassed-via-processbinding-mediumcve-2023-32559","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2023:1582","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:1583","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:2654","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:2655","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230608-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1205568","tags":["report"]},{"url":"https://bugzilla.suse.com/1208413","tags":["report"]},{"url":"https://bugzilla.suse.com/1208481","tags":["report"]},{"url":"https://bugzilla.suse.com/1208483","tags":["report"]},{"url":"https://bugzilla.suse.com/1208485","tags":["report"]},{"url":"https://bugzilla.suse.com/1208487","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-23918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-23919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-23920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-23936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24807","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230609-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230673-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230715-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230738-1/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-24807","title":"Undici vulnerable to Regular Expression Denial of Service in Headers","description":"Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.","status":"published","published":"2023-02-16T17:30:19.923Z","modified":"2025-03-10T21:10:32.171Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:35:27.006218Z"}],"euvd":[{"id":"EUVD-2023-0786","description":"Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.","status":"published","published":"2023-02-16T17:30:19Z","modified":"2025-03-10T21:10:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:53:09.197707Z"}],"ghsa":[{"id":"GHSA-r6ch-mqf9-qc9w","title":"Regular Expression Denial of Service in Headers","description":"### Impact\nThe `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function.\n\n### Patches\n\nThis vulnerability was patched in v5.19.1.\n\n### Workarounds\nThere is no workaround. Please update to an unaffected version.\n\n### References\n\n* https://hackerone.com/bugs?report_id=1784449\n\n### Credits\n\nCarter Snook reported this vulnerability.\n","status":"published","published":"2023-02-16T20:46:10Z","modified":"2023-02-16T20:46:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:36:45.67005Z"}],"nvd":[{"id":"CVE-2023-24807","description":"Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.","status":"published","published":"2023-02-16T18:15:12.34Z","modified":"2026-06-17T05:39:53.97Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-20","CWE-1333"],"updated_at":"2026-11-02T14:07:47.623983Z"}],"osv":[{"id":"ALPINE-CVE-2023-24807","description":"Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.","status":"published","published":"2023-02-16T18:15:12.34Z","modified":"2026-10-26T17:17:58.612486876Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:49.202584Z"},{"id":"AZL-13585","title":"CVE-2023-24807 affecting package nodejs for versions less than 16.19.1-1","description":"Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.","status":"published","published":"2023-02-16T18:15:12Z","modified":"2026-04-21T04:22:54.274132Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"BELL-CVE-2023-24807","title":"CVE-2023-24807 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:50.527761Z","modified":"2026-02-18T07:38:27.920216Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"CVE-2023-24807","title":"Undici vulnerable to Regular Expression Denial of Service in Headers","description":"Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.","status":"published","published":"2023-02-16T17:30:19.923Z","modified":"2026-10-28T02:31:06.037054279Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:44:30.709518Z"},{"id":"DEBIAN-CVE-2023-24807","description":"Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.","status":"published","published":"2023-02-16T18:15:12.34Z","modified":"2026-10-26T18:02:09.518124232Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"GHSA-r6ch-mqf9-qc9w","title":"Regular Expression Denial of Service in Headers","description":"### Impact\nThe `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function.\n\n### Patches\n\nThis vulnerability was patched in v5.19.1.\n\n### Workarounds\nThere is no workaround. Please update to an unaffected version.\n\n### References\n\n* https://hackerone.com/bugs?report_id=1784449\n\n### Credits\n\nCarter Snook reported this vulnerability.\n","status":"published","published":"2023-02-16T20:46:10Z","modified":"2026-09-10T03:50:07.876337712Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:46:55.480549Z"},{"id":"RHSA-2023:1582","title":"Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update","status":"published","published":"2024-10-22T00:35:12Z","modified":"2026-10-13T10:04:01Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1583","title":"Red Hat Security Advisory: nodejs:18 security, bug fix, and enhancement update","status":"published","published":"2024-10-22T00:35:24Z","modified":"2026-10-13T10:04:01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:2654","title":"Red Hat Security Advisory: nodejs:18 security, bug fix, and enhancement update","status":"published","published":"2024-10-22T00:36:26Z","modified":"2026-10-13T10:04:11Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:2655","title":"Red Hat Security Advisory: nodejs and nodejs-nodemon security, bug fix, and enhancement update","status":"published","published":"2024-09-29T23:58:08Z","modified":"2026-10-13T10:04:11Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:5533","title":"Red Hat Security Advisory: nodejs security, bug fix, and enhancement update","status":"published","published":"2024-09-29T23:58:35Z","modified":"2026-10-09T10:07:02Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RLSA-2023:2654","title":"Moderate: nodejs:18 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (18.14.2).\n\nSecurity Fix(es):\n\n* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n\n* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)\n\n* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)\n\n* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)\n\n* Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)\n\n* Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)\n\n* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)\n\n* Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-12-03T09:05:37.576021Z","modified":"2025-12-03T11:33:54.009749Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"ALSA-2023:1582","title":"Moderate: nodejs:16 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (16.19.1).\n\nSecurity Fix(es):\n\n* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)\n* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)\n* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)\n* Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)\n* Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)\n* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)\n* Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-04-04T00:00:00Z","modified":"2026-10-29T11:02:03.175038174Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2023:1583","title":"Moderate: nodejs:18 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (18.14.2).\n\nSecurity Fix(es):\n\n* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)\n* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)\n* Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)\n* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)\n* Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-04-04T00:00:00Z","modified":"2026-10-29T11:12:06.044141041Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2023:2654","title":"Moderate: nodejs:18 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (18.14.2).\n\nSecurity Fix(es):\n\n* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)\n* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)\n* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)\n* Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)\n* Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)\n* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)\n* Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-05-09T00:00:00Z","modified":"2026-10-29T11:31:26.123864832Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2023:2655","title":"Moderate: nodejs and nodejs-nodemon security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (16.19.1), nodejs-nodemon (2.0.20).\n\nSecurity Fix(es):\n\n* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)\n* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)\n* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)\n* Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)\n* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)\n* Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-05-09T00:00:00Z","modified":"2026-10-29T11:31:24.996241146Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"CLSA-2026-1788560495","title":"TuxCare security update for undici (14 CVEs)","description":"TuxCare rebuilt undici to address 14 CVEs. Fixed in 5.5.1-tuxcare.1.","status":"published","published":"2026-09-04T22:21:35Z","modified":"2026-10-15T09:48:03.135244229Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"openSUSE-SU-2024:12725-1","title":"corepack18-18.14.2-1.1 on GA media","description":"These are all security issues fixed in the corepack18-18.14.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:29:23.01924Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"openSUSE-SU-2024:12726-1","title":"corepack19-19.7.0-1.1 on GA media","description":"These are all security issues fixed in the corepack19-19.7.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:14:02.812891Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"RLSA-2023:1582","title":"Moderate: nodejs:16 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (16.19.1).\n\nSecurity Fix(es):\n\n* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n\n* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)\n\n* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)\n\n* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)\n\n* Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)\n\n* Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)\n\n* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)\n\n* Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-04-06T15:52:43.18089Z","modified":"2026-02-05T12:15:07.041362Z","updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"RLSA-2023:1583","title":"Moderate: nodejs:18 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (18.14.2).\n\nSecurity Fix(es):\n\n* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n\n* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)\n\n* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)\n\n* Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)\n\n* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)\n\n* Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-04-06T15:52:43.18089Z","modified":"2026-02-04T23:45:04.622287Z","updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"RLSA-2023:2655","title":"Moderate: nodejs and nodejs-nodemon security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (16.19.1), nodejs-nodemon (2.0.20).\n\nSecurity Fix(es):\n\n* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)\n\n* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)\n\n* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)\n\n* Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)\n\n* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)\n\n* Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-05-25T19:53:09.847906Z","modified":"2026-02-04T07:40:22.276968Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"SUSE-SU-2023:0608-1","title":"Security update for nodejs16","description":"This update for nodejs16 fixes the following issues:\n\nUpdate to LTS version 16.19.1:\n\n- CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule (bsc#1208481).\n- CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library (bsc#1208483).\n- CVE-2023-23920: Fixed insecure loading of ICU data through ICU_DATA environment (bsc#1208487).\n- CVE-2023-23936: Fixed protection against CRLF injection in host headers inside fetch API (bsc#1208485).\n- CVE-2023-24807: Fixed possible Regular Expression Denial of Service (ReDoS) via Headers.set() and Headers.append() methods (bsc#1208413).\n\nBug fixes:\n\n- Workaround for failing openssl-nodejs test (bsc#1205568).\n","status":"published","published":"2023-03-03T11:03:33Z","modified":"2026-02-04T02:42:30.823353Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:0609-1","title":"Security update for nodejs16","description":"This update for nodejs16 fixes the following issues:\n\nUpdate to LTS version 16.19.1:\n\n- CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule (bsc#1208481).\n- CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library (bsc#1208483).\n- CVE-2023-23920: Fixed insecure loading of ICU data through ICU_DATA environment (bsc#1208487).\n- CVE-2023-23936: Fixed protection against CRLF injection in host headers inside fetch API (bsc#1208485).\n- CVE-2023-24807: Fixed possible Regular Expression Denial of Service (ReDoS) via Headers.set() and Headers.append() methods (bsc#1208413).\n\nBug fixes:\n\n- Workaround for failing openssl-nodejs test (bsc#1205568).\n","status":"published","published":"2023-03-03T11:03:51Z","modified":"2026-02-04T03:51:03.63113Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:0673-1","title":"Security update for nodejs16","description":"This update for nodejs16 fixes the following issues:\n\nUpdate to LTS version 16.19.1:\n\n- CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule (bsc#1208481).\n- CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library (bsc#1208483).\n- CVE-2023-23920: Fixed insecure loading of ICU data through ICU_DATA environment (bsc#1208487).\n- CVE-2023-23936: Fixed protection against CRLF injection in host headers inside fetch API (bsc#1208485).\n- CVE-2023-24807: Fixed possible Regular Expression Denial of Service (ReDoS) via Headers.set() and Headers.append() methods (bsc#1208413).\n\nBug fixes:\n\n- Workaround for failing openssl-nodejs test (bsc#1205568).\n","status":"published","published":"2023-03-08T13:28:14Z","modified":"2025-05-02T04:34:37.832024Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:0715-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n  \nUpdate to NodeJS 18.14.2 LTS:\n\n- CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule (bsc#1208481).\n- CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library (bsc#1208483).\n- CVE-2023-23920: Fixed insecure loading of ICU data through ICU_DATA environment (bsc#1208487).\n- CVE-2023-23936: Fixed protection against CRLF injection in host headers inside fetch API (bsc#1208485).\n- CVE-2023-24807: Fixed possible Regular Expression Denial of Service (ReDoS) via Headers.set() and Headers.append() methods (bsc#1208413).\n","status":"published","published":"2023-03-13T09:58:51Z","modified":"2026-02-04T03:32:06.633419Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:0738-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\nUpdate to NodeJS 18.14.2 LTS:\n\n- CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule (bsc#1208481).\n- CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library (bsc#1208483).\n- CVE-2023-23920: Fixed insecure loading of ICU data through ICU_DATA environment (bsc#1208487).\n- CVE-2023-23936: Fixed protection against CRLF injection in host headers inside fetch API (bsc#1208485).\n- CVE-2023-24807: Fixed possible Regular Expression Denial of Service (ReDoS) via Headers.set() and Headers.append() methods (bsc#1208413).\n","status":"published","published":"2023-03-15T07:17:55Z","modified":"2026-02-04T03:50:14.024459Z","updated_at":"2026-11-02T15:53:52.350754Z"}]}}