CVE-2023-23936

Name of the Vulnerable Software and Affected Versions Undici versions 2.0.0 through 5.19.0

Description The issue is related to the undici library not protecting the host HTTP header from CRLF injection vulnerabilities. This could allow a remote attacker to inject arbitrary HTTP headers. The undici library is an HTTP/1.1 client for Node.js. As a workaround, sanitizing the headers.host string before passing it to undici can help mitigate the issue.

Recommendations For versions 2.0.0 through 5.19.0, update to version 5.19.1 to resolve the issue. As a temporary workaround, consider sanitizing the headers.host string before passing it to undici.