What’s Vulnerable › Vulnerabilities

CVE-2023-23936: CRLF Injection in Nodejs ‘undici’ via host

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-02-16 · updated 2026-06-17
• Weakness: CWE-93

Description

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.

Affected products

• Node.js: from 16.0.0 before 16.19.1; from 18.0.0 before 18.14.1; from 19.0.0 before 19.6.1 — fixed in 16.19.1, 18.14.1, 19.6.1
• undici: from 2.0.0 before 5.19.1 — fixed in 5.19.1
• Npm Undici: from 2.0.0 before 5.19.1 — fixed in 5.19.1

How to fix

Upgrade to a fixed version: Node.js 16.19.1, 18.14.1, 19.6.1; undici 5.19.1; Npm Undici 5.19.1. Check the vendor advisory for mitigations.

References

• https://github.com/nodejs/undici/commit/a2eff05401358f6595138df963837c24348f2034
• https://github.com/nodejs/undici/releases/tag/v5.19.1
• https://github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxff
• https://hackerone.com/reports/1820955
• https://github.com/nodejs/undici/commit/a2eff05401358f6595138df963837c24348f2034
• https://github.com/nodejs/undici/releases/tag/v5.19.1
• https://github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxff
• https://hackerone.com/reports/1820955

Get alerted when CVE-2023-23936 or the next vulnerability affects your stack