VDB
EN
LOW 3.9

GHSA-m4v8-wqvr-p9f7

Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline

상세

### Impact

Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`.

### Patches

This has been patched in https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75. Fixes has been released in v5.28.4 and v6.11.1.

### Workarounds

use `fetch()` or disable `maxRedirections`.

### References

Linzi Shang reported this.

* https://hackerone.com/reports/2408074 * https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3

이 버전이 영향받나요?

사용 중인 패키지 버전을 입력하면 즉시 평가합니다.

영향 패키지

npm / undici
최초 영향 버전: 0 수정 버전: 5.28.4
수정 npm install undici@5.28.4
npm / undici
최초 영향 버전: 6.0.0 수정 버전: 6.11.1
수정 npm install undici@6.11.1

참고