CVE-2023-23936

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.

• CWE-93
• CWE-74

• https://github.com/nodejs/undici/commit/a2eff05401358f6595138df963837c24348f2034Patch
• https://github.com/nodejs/undici/releases/tag/v5.19.1Release Notes
• https://github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxffVendor Advisory
• https://hackerone.com/reports/1820955Exploit, Third Party Advisory
• https://github.com/nodejs/undici/commit/a2eff05401358f6595138df963837c24348f2034Patch
• https://github.com/nodejs/undici/releases/tag/v5.19.1Release Notes
• https://github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxffVendor Advisory
• https://hackerone.com/reports/1820955Exploit, Third Party Advisory

Published

Feb 16, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-23930vantage6 is privacy preserving federated learning infrastruc…7.2
• CVE-2023-23931cryptography is a package designed to expose cryptographic p…6.5
• CVE-2023-23932OpenDDS is an open source C++ implementation of the Object M…7.5
• CVE-2023-23933OpenSearch Anomaly Detection identifies atypical data and re…4.3
• CVE-2023-23934Werkzeug is a comprehensive WSGI web application library. Br…3.5
• CVE-2023-23935Discourse is an open-source messaging platform. In versions …4.3
• CVE-2023-23937Pimcore is an Open Source Data & Experience Management Platf…5.4
• CVE-2023-23938Tuleap is a Free & Source tool for end to end traceability o…4.8
• CVE-2023-23939Azure/setup-kubectl is a GitHub Action for installing Kubect…7
• CVE-2023-2394A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. …4.8
• CVE-2023-23940OpenZeppelin Contracts for Cairo is a library for secure sma…5.3
• CVE-2023-23941SwagPayPal is a PayPal integration for shopware/platform. If…7.5