Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design, `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.
CVSS Details
- CVSS 3.1 Base Score: 3.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejsUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-full-i18n | Oct 23, 2023 | Oct 12, 2023 |
| Alpine Linux | — | Upgrade nodejsUpgrade openjdk21Upgrade nodejs-current | Mar 26, 2024 | Oct 12, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-npmUpgrade nodejs-full-i18nUpgrade v8-10.2-develUpgrade nodejs-develUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-docs | Feb 17, 2025 | Oct 12, 2023 |
| Centos_linux | — | Upgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade npm | Nov 1, 2023 | Oct 12, 2023 |
| Debian | — | Upgrade node-undici | Jul 30, 2024 | Oct 12, 2023 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 15, 2025 | Oct 12, 2023 |
| Oracle_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-devel | Oct 23, 2023 | Oct 12, 2023 |
| Redhat_linux | — | Upgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-nodemonNo solution existsUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs | Nov 1, 2023 | Oct 12, 2023 |
| Rocky_linux | — | — | Aug 15, 2024 | Oct 12, 2023 |
| Suse | — | Upgrade nodejs18-docsUpgrade corepack16Upgrade nodejs16Upgrade npm18Upgrade nodejs16-develUpgrade corepack18Upgrade nodejs18-develUpgrade nodejs18Upgrade nodejs16-docsUpgrade npm16 | Oct 23, 2023 | Oct 12, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub