You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Path to vulnerable library: /node_modules/undici/package.json
Dependency Hierarchy:
rest-0.6.0.tgz (Root Library)
❌ undici-5.7.0.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.
CVE-2023-24807 - High Severity Vulnerability
An HTTP/1.1 client, written from scratch for Node.js
Library home page: https://registry.npmjs.org/undici/-/undici-5.7.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/undici/package.json
Dependency Hierarchy:
Found in base branch: main
Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the
Headers.set()
andHeaders.append()
methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in theheaderValueNormalize()
utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.Publish Date: 2023-02-16
URL: CVE-2023-24807
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-r6ch-mqf9-qc9w
Release Date: 2023-02-16
Fix Resolution (undici): 5.19.1
Direct dependency fix Resolution (@discordjs/rest): 1.0.0
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: