Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.
CVSS Details
- CVSS 3.1 Base Score: 3.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade v8-10.2-develUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-libsUpgrade nodejs-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-npm | Dec 4, 2025 | Apr 4, 2024 |
| Debian | — | Upgrade node-undici | May 15, 2025 | Apr 4, 2024 |
| Suse | — | Upgrade nodejs16Upgrade nodejs18Upgrade nodejs16-develUpgrade nodejs18-develUpgrade corepack20Upgrade nodejs20-docsUpgrade npm16Upgrade corepack18Upgrade nodejs16-docsUpgrade nodejs18-docsUpgrade npm18Upgrade npm20Upgrade nodejs20-develUpgrade nodejs20 | Apr 17, 2024 | Apr 4, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub