Undici proxy-authorization header not cleared on cross-origin redirect in fetch [LOW] #171

New issue

Closed

opened 2024-02-20 17:40:36 +00:00 by Helpdesk · 0 comments

Helpdesk commented

2024-02-20 17:40:36 +00:00

Member

Package: undici (npm)
Affected versions: <= 5.28.2
Patched version: 5.28.3

Impact

Undici already cleared Authorization headers on cross-origin redirects, but did not clear Proxy-Authorization headers.

Patches

This is patched in v5.28.3 and v6.6.1

Workarounds

There are no known workarounds.

References

Package: undici (npm) Affected versions: <= 5.28.2 Patched version: 5.28.3 --- ## Impact Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authorization` headers. ## Patches This is patched in v5.28.3 and v6.6.1 ## Workarounds There are no known workarounds. ## References - https://fetch.spec.whatwg.org/#authentication-entries - [GHSA-wqq4-5wpv-mx2g](https://github.com/nodejs/undici/security/advisories/GHSA-wqq4-5wpv-mx2g)