Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline [LOW] [8] #198

New issue

Closed

opened 2024-04-08 15:21:31 +01:00 by Helpdesk · 0 comments

Helpdesk commented

2024-04-08 15:21:31 +01:00

Member

Package: undici (npm)
Affected versions: < 5.28.4
Patched version: 5.28.4

Impact

Undici cleared Authorisation and Proxy-Authorization headers for fetch(), but did not clear them for undici.request().

Patches

Fixes has been released in v5.28.4 and v6.11.1.

Workarounds

use fetch() or disable maxRedirections.

References

Linzi Shang reported this.

Package: undici (npm) Affected versions: < 5.28.4 Patched version: 5.28.4 --- ## Impact Undici cleared Authorisation and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. ## Patches Fixes has been released in v5.28.4 and v6.11.1. ## Workarounds use `fetch()` or disable `maxRedirections`. ## References Linzi Shang reported this. - https://hackerone.com/reports/2408074 - [GHSA-3787-6prv-h9w3](https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3)