CVE-2023-23936
MediumAdvisory
Published 16 Feb 2023In the index since 6 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.4
- base score, highest
- EPSS
- 0.011
- 65th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 23
- of 17,781 indexed, latest versions
- Container images
- 21
- deployed by those charts
- Fix available
- 2 of 2
- affected packages
CRLF Injection in Nodejs ‘undici’ via host
Carried by container images the latest versions of 23 of 17,781 indexed charts deploy, on 21 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| nodejsapk | 16.13.1-r0, 16.14.0-r0, 16.14.2-r0, 16.16.0-r0+1 more | 16.19.1-r0 | 9 |
| undicinpm | 4.15.0, 5.0.0, 5.6.0, 5.11.0+2 more | 5.19.1 | 12 |
- OSV records
- ALPINE-CVE-2023-23936GHSA-5r9g-qh6m-jxff
- Also known as
- BIT-node-2023-23936, BIT-node-min-2023-23936
Charts affected
23 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| graphql-hivegraphql-hive | 1.0.0 | 1 of 17See more | 10,311 |
| frpc-ingressinfinity-server | 0.4.1 | 1 of 1See more | 2,622 |
| difykubeblocksVerified publisher | 0.5.1 | 1 of 5See more | 20,403 |
| arbitrumchronicleVerified publisher | 0.3.4 | 1 of 1See more | 6,998 |
| authfcryptexlabsVerified publisher | 0.12.13 | 1 of 4See more | 3,769 |
| difydify | 1.0.0 | 1 of 4See more | 19,224 |
| dominodomino-iisasVerified publisher | 0.3.1 | 1 of 3See more | 10,270 |
| drogue-cloud-coredrogue-iotVerified publisher | 0.7.11 | 1 of 22See more | 55,666 |
| drogue-cloud-twindrogue-iotVerified publisher | 0.7.11 | 1 of 8See more | 6,915 |
| arbitrumdysnixVerified publisher | 0.1.1 | 1 of 1See more | 9,244 |
| blockscoutethereum-helm-chartsVerified publisher | 0.2.3 | 1 of 2See more | 1,928 |
| scanservjsgabe565Verified publisher | 0.9.2 | 1 of 1See more | 13,241 |
| openemrgeek-cookbookVerified publisher | 5.2.0 | 1 of 1See more | 8,392 |
| hive-appgraphql-hive | 1.0.0 | 1 of 1See more | 2,682 |
| hive-appgraphql-hive-subcharts | 1.0.0 | 1 of 1See more | 2,682 |
| dtlinfradao | 0.0.1 | 1 of 1See more | 4,944 |
| deconzjanip81-helm-chartsVerified publisher | 0.1.1 | 1 of 1See more | 10,780 |
| nocodbkrzwiatrzyk | 0.0.1 | 1 of 1See more | 2,313 |
| swaggerncsaVerified publisher | 1.0.1 | 1 of 1See more | 1,185 |
| petioobeoneVerified publisher | 1.0.2 | 1 of 1See more | 795 |
| blockscoutparadeum-teamVerified publisher | 0.1.5 | 1 of 1See more | 3,448 |
| k8soketisoketi | 1.0.1 | 1 of 1See more | 2,267 |
| trudesktechpreta | 1.0.0 | 1 of 3See more | 4,017 |
Container images carrying it
21 by charts deploying them
A fixed version is listed for 2 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | a4a3639899f7 | undici | 5.19.1 | 3 |
| blockscout/ | c365a8f2dc12 | nodejs | 16.19.1-r0 | 1 |
| cryptexlabs/ | 189c07411d7c | undici | 5.19.1 | 1 |
| deconzcommunity/ | 062de2362641 | undici | 5.19.1 | 1 |
| ethereumoptimism/ | e07968a0e686 | undici | 5.19.1 | 1 |
| langgenius/ | 066035f93856 | undici | 5.19.1 | 1 |
| langgenius/ | fca918260dd6 | undici | 5.19.1 | 1 |
| nocodb/ | b0b91ec2a2dd | nodejs | 16.19.1-r0 | 1 |
| offchainlabs/ | 9f779fa84b7b | undici | 5.19.1 | 1 |
| offchainlabs/ | e95865866129 | undici | 5.19.1 | 1 |
| openemr/ | 89eaa6d9a4e3 | nodejs | 16.19.1-r0 | 1 |
| polonel/ | 0cf6513f6fe3 | undici | 5.19.1 | 1 |
| sbs20/ | dad1fd6e9a98 | undici | 5.19.1 | 1 |
| springhack/ | 4aceb821da88 | nodejs | 16.19.1-r0 | 1 |
| swaggerapi/ | 0d7088d47928 | nodejs | 16.19.1-r0 | 1 |
| swaggerapi/ | 11b20aebb92c | nodejs | 16.19.1-r0 | 1 |
| swaggerapi/ | 7ff9a86f35ff | nodejs | 16.19.1-r0 | 1 |
| ghcr.io/ | 8e53861be292 | undici | 5.19.1 | 1 |
| ghcr.io/ | a5802962de0f | nodejs | 16.19.1-r0 | 1 |
| quay.io/ | becd3e39360a | nodejs | 16.19.1-r0 | 1 |
| quay.io/ | 4cd9ea9434c4 | undici | 5.19.1 | 1 |