ALPINE-CVE-2023-23936 — Vulnetix

Try Vulnetix Request Demo

ALPINE-CVE-2023-23936 PUBLISHED CVSS 5.400000095367432 MEDIUM

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.

Risk Scores

CVSS v3.1

5.400000095367432

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected Products

Vendor	Product	Versions
Alpine:v3.20	nodejs	16.14.2-r0, 8.9.4-r0, 8.9.3-r1
Alpine:v3.18	nodejs	0, 8.9.4-r0, 8.9.3-r1
Alpine:v3.23	nodejs	0, 0, 0
Alpine:v3.17	nodejs	6.10.0-r0, 18.12.0-r0, 6.9.1-r0
Alpine:v3.16	nodejs	4.4.3-r0, 8.9.4-r0, 8.9.3-r1
Alpine:v3.19	nodejs	14.15.4-r0, 14.17.5-r0, 14.17.6-r0
Alpine:v3.21	nodejs	0, 0, 0
Alpine:v3.22	nodejs	0, 0, 0
Alpine:v3.15	nodejs	6.10.3-r0, 14.17.0-r0, 14.16.1-r2

Timeline

Feb 16, 2023 CVE Published
Dec 3, 2025 CVE Updated
Apr 30, 2026 Distribution Patch

References

https://security.alpinelinux.org/vuln/CVE-2023-23936 advisory

Open in Interactive Console →