VDB
KO
LOW 3.9

GHSA-m4v8-wqvr-p9f7

Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline

Details

### Impact

Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`.

### Patches

This has been patched in https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75. Fixes has been released in v5.28.4 and v6.11.1.

### Workarounds

use `fetch()` or disable `maxRedirections`.

### References

Linzi Shang reported this.

* https://hackerone.com/reports/2408074 * https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3

Are you affected?

Enter the version of the package you're using.

Affected packages

npm / undici
Introduced in: 0 Fixed in: 5.28.4
Fix npm install undici@5.28.4
npm / undici
Introduced in: 6.0.0 Fixed in: 6.11.1
Fix npm install undici@6.11.1

References