Skip to content
OpenAdvisories

Vendor

nodejs

144 known vulnerabilities.

Products

node 129 undici 15 nodejs 1
All Critical High Medium Low Exploited only Public exploit

43 results · Clear filters · Feed

  • Medium 5.3
    CVE-2022-35948

    CRLF Injection in Nodejs ‘undici’ via Content-Type

    undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specifically, inside the `content-type` header. Example: ``` import { re…

    nodejs undici node-undici undici Debian npm
  • Medium 5.3
    CVE-2022-35949

    `undici.request` vulnerable to SSRF using absolute URL on `pathname`

    undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`. If a user specifies a URL such as `htt…

    nodejs undici node-undici undici Debian npm
  • Medium 5.3
    CVE-2022-31150

    CRLF injection in request headers

    undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to elim…

    nodejs undici node-undici node-undici Debian Ubuntu npm