Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Details
- CVSS 3.1 Base Score: 3.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade nodejs20-libsUpgrade nodejs20-develUpgrade nodejs20-docsUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs20-libs-debuginfoUpgrade nodejs20Upgrade nodejs20-debugsourceUpgrade nodejs20-full-i18nUpgrade nodejs20-debuginfoUpgrade nodejs-debuginfoUpgrade nodejsUpgrade v8-10.2-develUpgrade nodejs-debugsourceUpgrade nodejs-npmUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-docsUpgrade nodejs20-npmUpgrade v8-11.3-devel | Jul 4, 2025 | Feb 16, 2024 |
| Debian | — | No solution existsUpgrade node-undici | May 15, 2025 | Feb 16, 2024 |
| Suse | — | Upgrade nodejs16-docsUpgrade npm16Upgrade nodejs18Upgrade corepack20Upgrade corepack18Upgrade nodejs18-docsUpgrade npm18Upgrade nodejs20-develUpgrade nodejs20Upgrade nodejs16Upgrade npm20Upgrade nodejs20-docsUpgrade nodejs18-develUpgrade nodejs16-devel | Feb 29, 2024 | Feb 16, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub