What is GHSA-5r9g-qh6m-jxff?

GHSA-5r9g-qh6m-jxff is a security advisory published by GitHub Security Advisories with Medium severity. CRLF Injection in Nodejs ‘undici’ via host

Which CVE IDs does GHSA-5r9g-qh6m-jxff cover?

GHSA-5r9g-qh6m-jxff covers the following CVE IDs: CVE-2023-23936. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5r9g-qh6m-jxff?

GHSA-5r9g-qh6m-jxff has a CVSS v3 base score of 4.6, published by GitHub Security Advisories.

Which products are affected by GHSA-5r9g-qh6m-jxff?

GHSA-5r9g-qh6m-jxff affects 1 product, including: npm/undici:\u003e= 2.0.0, \u003c 5.19.1.

GHSA-5r9g-qh6m-jxffMediumCVSS 4.6

CRLF Injection in Nodejs ‘undici’ via host

Vendor

GitHub Security Advisories

Published

February 16, 2023

Last Modified

February 24, 2023

🔗 CVE IDs covered (1)

CVE-2023-23936 →

📋 Description

Impact

undici library does not protect host HTTP header from CRLF injection vulnerabilities.

Patches

This issue was patched in Undici v5.19.1.

Workarounds

Sanitize the headers.host string before passing to undici.

References

Reported at https://hackerone.com/reports/1820955.

Credits

Thank you to Zhipeng Zhang (@timon8) for reporting this vulnerability.

🎯 Affected products1

npm/undici:>= 2.0.0, < 5.19.1

🔗 References (6)

https://github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxff
https://nvd.nist.gov/vuln/detail/CVE-2023-23936
https://github.com/nodejs/undici/commit/a2eff05401358f6595138df963837c24348f2034
https://hackerone.com/reports/1820955
https://github.com/nodejs/undici/releases/tag/v5.19.1
https://github.com/advisories/GHSA-5r9g-qh6m-jxff