Debian/node-undici: medium 6.5
A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`. This inconsistency enables request smuggling, allowing attackers to
Action: Upgrade node-undici to 7.15.0+dfsg+~cs3.2.0-1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 7.15.0+dfsg+~cs3.2.0-1 | - |
Fixed versions
| 7.15.0+dfsg+~cs3.2.0-1 |
Sources
- osv: DEBIAN-CVE-2025-23167#Debian:14/node-undici
- https://security-tracker.debian.org/tracker/CVE-2025-23167
published · modified · JSON