The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design, `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-packaging | Oct 23, 2023 | Oct 12, 2023 |
| Alpine Linux | — | Upgrade nodejs-currentUpgrade openjdk21Upgrade nodejs | Mar 26, 2024 | Oct 12, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs-npmUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade v8-10.2-devel | Feb 17, 2025 | Oct 12, 2023 |
| Centos_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-packaging | Nov 1, 2023 | Oct 12, 2023 |
| Debian | — | Upgrade node-undici | Jul 30, 2024 | Oct 12, 2023 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 15, 2025 | Oct 12, 2023 |
| Oracle_linux | — | Upgrade nodejs-develUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade npm | Oct 23, 2023 | Oct 12, 2023 |
| Redhat_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-debugsourceNo solution existsUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade npm | Nov 1, 2023 | Oct 12, 2023 |
| Rocky_linux | — | — | Aug 15, 2024 | Oct 12, 2023 |
| Suse | — | Upgrade npm18Upgrade nodejs18-docsUpgrade nodejs16Upgrade corepack16Upgrade nodejs16-develUpgrade nodejs18-develUpgrade npm16Upgrade nodejs16-docsUpgrade corepack18Upgrade nodejs18 | Oct 23, 2023 | Oct 12, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub