Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Details
- CVSS 3.1 Base Score: 3.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade nodejs-docsUpgrade nodejs20-npmUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade v8-11.3-develUpgrade nodejs-npmUpgrade nodejs20-develUpgrade nodejs20Upgrade nodejsUpgrade nodejs20-full-i18nUpgrade nodejs20-debugsourceUpgrade nodejs20-libsUpgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs20-docsUpgrade nodejs20-libs-debuginfoUpgrade nodejs20-debuginfoUpgrade v8-10.2-devel | Jul 4, 2025 | Feb 16, 2024 |
| Debian | — | Upgrade node-undici | May 15, 2025 | Feb 16, 2024 |
| Suse | — | Upgrade nodejs18-develUpgrade nodejs20Upgrade nodejs16-develUpgrade nodejs20-docsUpgrade nodejs16Upgrade npm20Upgrade nodejs16-docsUpgrade nodejs18Upgrade npm18Upgrade nodejs20-develUpgrade nodejs18-docsUpgrade corepack18Upgrade npm16Upgrade corepack20 | Feb 29, 2024 | Feb 16, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub