Lucene search

GitHub Advisory DatabaseGHSA-3787-6PRV-H9W3

HistoryFeb 16, 2024 - 4:02 p.m.

Undici proxy-authorization header not cleared on cross-origin redirect in fetch

2024-02-1616:02:52

CWE-200

GitHub Advisory Database

github.com

103

undici

proxy-authorization

cross-origin redirect

fetch

security

patches

workarounds

references

whatwg

nodejs

advisories.

7.1 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.1%

JSON

Impact

Undici already cleared Authorization headers on cross-origin redirects, but did not clear Proxy-Authorization headers.

Patches

This is patched in v5.28.3 and v6.6.1

Workarounds

There are no known workarounds.

References

CPENameOperatorVersion
undicile6.6.0
undicile5.28.2

CPE	Name	Operator	Version
	undici	le	6.6.0
	undici	le	5.28.2

References

www.openwall.com/lists/oss-security/2024/03/11/1

github.com/advisories/GHSA-3787-6prv-h9w3

github.com/nodejs/undici/commit/b9da3e40f1f096a06b4caedbb27c2568730434ef

github.com/nodejs/undici/commit/d3aa574b1259c1d8d329a0f0f495ee82882b1458

github.com/nodejs/undici/releases/tag/v5.28.3

github.com/nodejs/undici/releases/tag/v6.6.1

github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3

nvd.nist.gov/vuln/detail/CVE-2024-24758

security.netapp.com/advisory/ntap-20240419-0007