MediumGHSA-5r9g-qh6m-jxffBIT-node-2023-23936BIT-node-min-2023-23936CVE-2023-23936
CRLF Injection in Nodejs ‘undici’ via host
Published 16 Feb 2023 · Updated 10 Sept 2026
Affected package
undicinpm
- Affected
- >=2.0.0 <5.19.1
- Fixed in
- 5.19.1
Update to the fixed version for your release line, for example:
npm install undici@5.19.1Details
Impact
undici library does not protect host HTTP header from CRLF injection vulnerabilities.
Patches
This issue was patched in Undici v5.19.1.
Workarounds
Sanitize the headers.host string before passing to undici.
References
Reported at https://hackerone.com/reports/1820955.
Credits
Thank you to Zhipeng Zhang (@timon8) for reporting this vulnerability.
Is GHSA-5r9g-qh6m-jxff in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected undici, and gives you the command that fixes it.
References
- Linkgithub.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxff
- Advisorynvd.nist.gov/vuln/detail/CVE-2023-23936
- Linkgithub.com/nodejs/undici/commit/a2eff05401358f6595138df963837c24348f2034
- Linkhackerone.com/reports/1820955
- Packagegithub.com/nodejs/undici
- Linkgithub.com/nodejs/undici/releases/tag/v5.19.1
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.