Vulnerabilities > CVE-2022-31151 - Unspecified vulnerability in Nodejs Undici

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

LOW

Integrity impact

LOW

Availability impact

NONE

network

low complexity

nodejs

NVD

Published: 2022-07-21

Updated: 2024-11-21

Summary

Authorization headers are cleared on cross-origin redirect. However, cookie headers which are sensitive headers and are official headers found in the spec, remain uncleared. There are active users using cookie headers in undici. This may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site. This was patched in v5.7.1. By default, this vulnerability is not exploitable. Do not enable redirections, i.e. `maxRedirections: 0` (the default).

Vulnerable Configurations

Part	Description	Count
Application	Nodejs Nodejs Undici - Nodejs Undici 1.0.0 Nodejs Undici 1.0.1 Nodejs Undici 1.0.2 Nodejs Undici 1.0.3 Nodejs Undici 1.1.0 Nodejs Undici 1.2.0 Nodejs Undici 1.2.1 Nodejs Undici 1.2.2 Nodejs Undici 1.2.4 Nodejs Undici 1.2.5 Nodejs Undici 1.2.6 Nodejs Undici 1.3.0 Nodejs Undici 1.3.1 Nodejs Undici 2.0.0 Nodejs Undici 2.0.1 Nodejs Undici 2.0.2 Nodejs Undici 2.0.3 Nodejs Undici 2.0.4 Nodejs Undici 2.0.5 Nodejs Undici 2.0.6 Nodejs Undici 2.0.7 Nodejs Undici 2.1.0 Nodejs Undici 2.1.1 Nodejs Undici 2.2.0 Nodejs Undici 2.2.1 Nodejs Undici 3.0.0 Nodejs Undici 3.1.0 Nodejs Undici 3.2.0 Nodejs Undici 3.3.0 Nodejs Undici 3.3.1 Nodejs Undici 3.3.2 Nodejs Undici 3.3.3 Nodejs Undici 3.3.4 Nodejs Undici 3.3.5 Nodejs Undici 3.3.6 Nodejs Undici 4.0.0 Nodejs Undici 4.1.0 Nodejs Undici 4.1.1 Nodejs Undici 4.2.0 Nodejs Undici 4.2.1 Nodejs Undici 4.2.2 Nodejs Undici 4.3.0 Nodejs Undici 4.3.1 Nodejs Undici 4.4.0 Nodejs Undici 4.4.1 Nodejs Undici 4.4.2 Nodejs Undici 4.4.3 Nodejs Undici 4.4.4 Nodejs Undici 4.4.5 Nodejs Undici 4.4.6 Nodejs Undici 4.4.7 Nodejs Undici 4.5.0 Nodejs Undici 4.5.1 Nodejs Undici 4.6.0 Nodejs Undici 4.7.0 Nodejs Undici 4.7.1 Nodejs Undici 4.7.2 Nodejs Undici 4.7.3 Nodejs Undici 4.8.0 Nodejs Undici 4.8.1 Nodejs Undici 4.8.2 Nodejs Undici 4.9.0 Nodejs Undici 4.9.1 Nodejs Undici 4.9.2 Nodejs Undici 4.9.3 Nodejs Undici 4.9.4 Nodejs Undici 4.9.5 Nodejs Undici 4.10.0 Nodejs Undici 4.10.1 Nodejs Undici 4.10.2 Nodejs Undici 4.10.3 Nodejs Undici 4.10.4 Nodejs Undici 4.11.0 Nodejs Undici 4.11.1 Nodejs Undici 4.11.2 Nodejs Undici 4.11.3 Nodejs Undici 4.12.0 Nodejs Undici 4.12.1 Nodejs Undici 4.12.2 Nodejs Undici 4.13.0 Nodejs Undici 4.14.0 Nodejs Undici 4.14.1 Nodejs Undici 4.15.0 Nodejs Undici 4.15.1 Nodejs Undici 4.16.0 Nodejs Undici 5.0.0 Nodejs Undici 5.1.0 Nodejs Undici 5.1.1 Nodejs Undici 5.2.0 Nodejs Undici 5.3.0 Nodejs Undici 5.4.0 Nodejs Undici 5.5.0 Nodejs Undici 5.5.1 Nodejs Undici 5.6.0 Nodejs Undici 5.6.1 Nodejs Undici 5.7.0	111

Summary

Vulnerable Configurations

References