Executive brief
Node.js undici is a popular HTTP client library used in backend applications. The Headers.set() and Headers.append() methods contain a vulnerability that allows attackers to cause a denial of service by passing specially crafted header values, potentially freezing or crashing applications that process untrusted HTTP headers.
Technical details
This is a Regular Expression Denial of Service (ReDoS) vulnerability (CWE-1333) in the headerValueNormalize() utility function. The inefficient regex pattern used to validate and normalize header values can be exploited with malicious input, causing excessive CPU consumption and service unavailability. An attacker can trigger this via the Headers.set() or Headers.append() methods by providing specially crafted untrusted values. The vulnerability requires the attacker to have some level of privilege to pass input to these methods, though attack complexity is noted as high on the GitHub advisory. The vulnerability was patched in version 5.19.1 of undici.
Affected products
- Node.js undici <5.19.1
Timeline
- 2023-02-16: disclosed
- 2023-02-16: patched: Version 5.19.1 released