Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Details
- CVSS 3.1 Base Score: 3.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade nodejs20-develUpgrade nodejs-debuginfoUpgrade nodejs20-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs20-libs-debuginfoUpgrade nodejs20-libsUpgrade nodejs20Upgrade nodejs20-full-i18nUpgrade nodejs20-debugsourceUpgrade nodejsUpgrade nodejs-libsUpgrade v8-10.2-develUpgrade nodejs20-docsUpgrade nodejs-develUpgrade nodejs-docsUpgrade v8-11.3-develUpgrade nodejs-npmUpgrade nodejs20-npmUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfo | Jul 4, 2025 | Feb 16, 2024 |
| Debian | — | Upgrade node-undiciNo solution exists | May 15, 2025 | Feb 16, 2024 |
| Suse | — | Upgrade corepack20Upgrade npm16Upgrade npm18Upgrade nodejs20-develUpgrade nodejs18-docsUpgrade nodejs16-docsUpgrade corepack18Upgrade nodejs18Upgrade nodejs20-docsUpgrade nodejs18-develUpgrade nodejs16Upgrade nodejs16-develUpgrade npm20Upgrade nodejs20 | Feb 29, 2024 | Feb 16, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub