[22] Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline #442

New issue

Closed

opened 2024-06-24 18:37:13 +01:00 by Helpdesk · 0 comments

Helpdesk commented

2024-06-24 18:37:13 +01:00

Member

Package: undici (npm)
Affected versions: < 5.28.4
Patched version: 5.28.4

GitHub

Impact

Undici cleared Authorization and Proxy-Authorization headers for fetch(), but did not clear them for undici.request().

Patches

This has been patched in nodejs/undici.
Fixes has been released in v5.28.4 and v6.11.1.

Workarounds

use fetch() or disable maxRedirections.

References

Linzi Shang reported this.

Package: undici (npm) Affected versions: < 5.28.4 Patched version: 5.28.4 [GitHub](https://github.com/Vylpes/vylbot-app/security/dependabot/22) --- ## Impact Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. ## Patches This has been patched in [nodejs/undici](https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75). Fixes has been released in v5.28.4 and v6.11.1. ## Workarounds use `fetch()` or disable `maxRedirections`. ## References Linzi Shang reported this. - https://hackerone.com/reports/2408074 - https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3