Process hang via inefficient header normalization regex

Regular expression denial of service in Node.js Undici before 5.19.1 allows attackers to hang a process through crafted header values. The headerValueNormalize() utility applies a trailing-whitespace regular expression that repeatedly rescans a long internal whitespace run when the end anchor cannot match. Exploitation requires an application to pass attacker-controlled values to Headers.set() or Headers.append(), blocking that Node.js event loop without disclosing or changing data.