Vulnerability record · CVE-2023-23936 · published 16 February 2023

CVE-2023-23936: Nodejs node.js injection vulnerability

Nodejs · Node.Js

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.

5.4 CVSS 3.1 Medium EPSS 1.1% · top 34.9% CWE-93 · CWE-93CWE-74 · Injection

5.4CVSS 3.1 base score

1.1%EPSS exploitation probability, 30 days

NoNot in CISA KEV

2Affected product versions listed by NVD

8References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Node.Js Nodejs

Undici Nodejs

References

Link	Tags
https://github.com/nodejs/undici/commit/a2eff05401358f6595138df963837c24348f2034	Patch
https://github.com/nodejs/undici/releases/tag/v5.19.1	Release Notes
https://github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxff	Vendor Advisory
https://hackerone.com/reports/1820955	ExploitThird Party Advisory
https://github.com/nodejs/undici/commit/a2eff05401358f6595138df963837c24348f2034	Patch
https://github.com/nodejs/undici/releases/tag/v5.19.1	Release Notes
https://github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxff	Vendor Advisory
https://hackerone.com/reports/1820955	ExploitThird Party Advisory

Track CVE-2023-23936 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2023-44487HTTP/2 Rapid Reset stream cancellation denial of serviceThe HTTP/2 protocol permits a client to cancel many streams quickly, and the server's handling of those resets consumes disproportionate resources. T…KEVEPSS 100%analysed10 Oct 2023 10.0CVE-2026-21636Nodejs node.js improper access control vulnerabilityA flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even …EPSS 0.88%20 Jan 2026 10.0CVE-2015-0278Fedoraproject fedora vulnerabilitylibuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors.EPSS 3.2%18 May 2015 9.8CVE-2026-48930Nodejs node.js improper access control vulnerabilityA flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolve…EPSS 0.32%26 Jun 2026 9.8CVE-2026-1525Nodejs undici http request smuggling vulnerabilityUndici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-leng…EPSS 0.49%12 Mar 2026 9.8CVE-2024-3566Haskell process library command injection vulnerabilityA command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess fu…EPSS 6.9%10 Apr 2024 9.8CVE-2024-21896Nodejs node.js vulnerabilityThe permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be tr…EPSS 1.3%20 Feb 2024 9.8CVE-2023-39332Nodejs node.js path traversal vulnerabilityVarious `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the…EPSS 1.8%18 Oct 2023

Source: NIST National Vulnerability Database (record CVE-2023-23936), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.