Regular Expression Denial Of Service (ReDoS)

undici is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability exists due to an insecure Regex pattern used in the headerValueNormalize function in headers.js, which allows an attacker to crash the application by providing a malicious input...

PT-2023-19790

Name of the Vulnerable Software and Affected Versions Undici versions prior to 5.19.1 Description Undici is an HTTP/1.1 client for Node.js. The Headers.set and Headers.append methods are vulnerable to Regular Expression Denial of Service ReDoS attacks when untrusted values are passed into the...

CVE-2023-24807: Improper Input Validation

Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the Headers.set and Headers.append methods are vulnerable to Regular Expression Denial of Service ReDoS attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normali...