Every CVE Search/ Get API key

CVE-2022-35949

`undici.request` vulnerable to SSRF using absolute URL on `pathname`

5.3 MediumFix available

undici is an HTTP/1.1 client, written from scratch for Node.js.undici is vulnerable to SSRF (Server-side Request Forgery) when an application takes in user input into the path/pathname option of undici.request. If a user specifies a URL such as http://127.0.0.1 or //127.0.0.1 js const undici = require("undici") undici.request({origin: "http://example.com", pathname: "//127.0.0.1"}) Instead of processing the request as http://example.org//127.0.0.1 (or http://example.org/http://127.0.0.1 when http://127.0.0.1 is used), it actually processes the request as http://127.0.0.1/ and sends it to http://127.0.0.1. If a developer passes in user input into path parameter of undici.request, it can result in an SSRF as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL. This issue was fixed in [email protected]. The best workaround is to validate user input before passing it to the undici.request call.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

1.93%Up 1.0 points since Aug 13, 2022
90%50%10%1%

What each source reports

CVE List Score used 5.3

`undici.request` vulnerable to SSRF using absolute URL on `pathname`

undici is an HTTP/1.1 client, written from scratch for Node.js.undici is vulnerable to SSRF (Server-side Request Forgery) when an application takes in user input into the path/pathname option of undici.request. If a user specifies a URL such as http://127.0.0.1 or //127.0.0.1 js const undici = require("undici") undici.request({origin: "http://example.com", pathname: "//127.0.0.1"}) Instead of processing the request as http://example.org//127.0.0.1 (or http://example.org/http://127.0.0.1 when http://127.0.0.1 is used), it actually processes the request as http://127.0.0.1/ and sends it to http://127.0.0.1. If a developer passes in user input into path parameter of undici.request, it can result in an SSRF as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL. This issue was fixed in [email protected]. The best workaround is to validate user input before passing it to the undici.request call.

Record
CVE-2022-35949
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02
EUVDEUVD-2022-6518 5.3

undici is an HTTP/1.1 client, written from scratch for Node.js.undici is vulnerable to SSRF (Server-side Request Forgery) when an application takes in user input into the path/pathname option of undici.request. If a user specifies a URL such as http://127.0.0.1 or //127.0.0.1 js const undici = require("undici") undici.request({origin: "http://example.com", pathname: "//127.0.0.1"}) Instead of processing the request as http://example.org//127.0.0.1 (or http://example.org/http://127.0.0.1 when http://127.0.0.1 is used), it actually processes the request as http://127.0.0.1/ and sends it to http://127.0.0.1. If a developer passes in user input into path parameter of undici.request, it can result in an SSRF as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL. This issue was fixed in [email protected]. The best workaround is to validate user input before passing it to the undici.request call.

Record
EUVD-2022-6518
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-8qr4-xgw6-wmr3 5.3

`undici.request` vulnerable to SSRF using absolute URL on `pathname`

Impact

undici is vulnerable to SSRF (Server-side Request Forgery) when an application takes in user input into the path/pathname option of undici.request.

If a user specifies a URL such as http://127.0.0.1 or //127.0.0.1

const undici = require("undici")
undici.request({origin: "http://example.com", pathname: "//127.0.0.1"})

Instead of processing the request as http://example.org//127.0.0.1 (or http://example.org/http://127.0.0.1 when http://127.0.0.1 is used), it actually processes the request as http://127.0.0.1/ and sends it to http://127.0.0.1.

If a developer passes in user input into path parameter of undici.request, it can result in an SSRF as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL.

Patches

This issue was fixed in [email protected].

Workarounds

The best workaround is to validate user input before passing it to the undici.request call.

For more information

If you have any questions or comments about this advisory:

Record
GHSA-8qr4-xgw6-wmr3
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02
NVD 5.3

undici is an HTTP/1.1 client, written from scratch for Node.js.undici is vulnerable to SSRF (Server-side Request Forgery) when an application takes in user input into the path/pathname option of undici.request. If a user specifies a URL such as http://127.0.0.1 or //127.0.0.1 js const undici = require("undici") undici.request({origin: "http://example.com", pathname: "//127.0.0.1"}) Instead of processing the request as http://example.org//127.0.0.1 (or http://example.org/http://127.0.0.1 when http://127.0.0.1 is used), it actually processes the request as http://127.0.0.1/ and sends it to http://127.0.0.1. If a developer passes in user input into path parameter of undici.request, it can result in an SSRF as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL. This issue was fixed in [email protected]. The best workaround is to validate user input before passing it to the undici.request call.

Record
CVE-2022-35949
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-918
Updated
2026-11-02
OSV 5.3

`undici.request` vulnerable to SSRF using absolute URL on `pathname`

undici is an HTTP/1.1 client, written from scratch for Node.js.undici is vulnerable to SSRF (Server-side Request Forgery) when an application takes in user input into the path/pathname option of undici.request. If a user specifies a URL such as http://127.0.0.1 or //127.0.0.1 js const undici = require("undici") undici.request({origin: "http://example.com", pathname: "//127.0.0.1"}) Instead of processing the request as http://example.org//127.0.0.1 (or http://example.org/http://127.0.0.1 when http://127.0.0.1 is used), it actually processes the request as http://127.0.0.1/ and sends it to http://127.0.0.1. If a developer passes in user input into path parameter of undici.request, it can result in an SSRF as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL. This issue was fixed in [email protected]. The best workaround is to validate user input before passing it to the undici.request call.

Record
CVE-2022-35949
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02
OSVGHSA-8qr4-xgw6-wmr3 5.3

`undici.request` vulnerable to SSRF using absolute URL on `pathname`

Impact

undici is vulnerable to SSRF (Server-side Request Forgery) when an application takes in user input into the path/pathname option of undici.request.

If a user specifies a URL such as http://127.0.0.1 or //127.0.0.1

const undici = require("undici")
undici.request({origin: "http://example.com", pathname: "//127.0.0.1"})

Instead of processing the request as http://example.org//127.0.0.1 (or http://example.org/http://127.0.0.1 when http://127.0.0.1 is used), it actually processes the request as http://127.0.0.1/ and sends it to http://127.0.0.1.

If a developer passes in user input into path parameter of undici.request, it can result in an SSRF as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL.

Patches

This issue was fixed in [email protected].

Workarounds

The best workaround is to validate user input before passing it to the undici.request call.

For more information

If you have any questions or comments about this advisory:

Record
GHSA-8qr4-xgw6-wmr3
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02
Show 6 moreShow less
OSVCLSA-2026-1788560495 No score

TuxCare security update for undici (14 CVEs)

TuxCare rebuilt undici to address 14 CVEs. Fixed in 5.5.1-tuxcare.1.

Record
CLSA-2026-1788560495
Updated
2026-11-02
OSVDEBIAN-CVE-2022-35949 No score

undici is an HTTP/1.1 client, written from scratch for Node.js.undici is vulnerable to SSRF (Server-side Request Forgery) when an application takes in user input into the path/pathname option of undici.request. If a user specifies a URL such as http://127.0.0.1 or //127.0.0.1 js const undici = require("undici") undici.request({origin: "http://example.com", pathname: "//127.0.0.1"}) Instead of processing the request as http://example.org//127.0.0.1 (or http://example.org/http://127.0.0.1 when http://127.0.0.1 is used), it actually processes the request as http://127.0.0.1/ and sends it to http://127.0.0.1. If a developer passes in user input into path parameter of undici.request, it can result in an SSRF as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL. This issue was fixed in [email protected]. The best workaround is to validate user input before passing it to the undici.request call.

Record
DEBIAN-CVE-2022-35949
Updated
2026-11-03
OSVopenSUSE-SU-2024:12285-1 No score

corepack16-16.17.0-2.1 on GA media

These are all security issues fixed in the corepack16-16.17.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12285-1
Updated
2026-11-02
OSVSUSE-SU-2022:3196-1 No score

Security update for nodejs16

This update for nodejs16 fixes the following issues:

  • CVE-2022-35949: Fixed SSRF when an application takes in user input into the path/pathname option of undici.request (bsc#1202382).
  • CVE-2022-35948: Fixed CRLF injection via Content-Type (bsc#1202383).
  • CVE-2022-29244: Fixed npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (bsc#1200517).
  • CVE-2022-31150: Fixed CRLF injection in node-undici (bsc#1201710).

Bugfixes:

  • Enable crypto-policies for SLE15 SP4+ and TW (bsc#1200303)
Record
SUSE-SU-2022:3196-1
Updated
2026-11-02
OSVSUSE-SU-2022:3250-1 No score

Security update for nodejs16

This update for nodejs16 fixes the following issues:

  • CVE-2022-35949: Fixed SSRF when an application takes in user input into the path/pathname option of undici.request (bsc#1202382).
  • CVE-2022-35948: Fixed CRLF injection via Content-Type (bsc#1202383).
  • CVE-2022-29244: Fixed npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (bsc#1200517).
  • CVE-2022-31150: Fixed CRLF injection in node-undici (bsc#1201710).

Bugfixes:

  • Enable crypto-policies for SLE15 SP4+ and TW (bsc#1200303)
Record
SUSE-SU-2022:3250-1
Updated
2026-11-02
OSVSUSE-SU-2022:3251-1 No score

Security update for nodejs16

This update for nodejs16 fixes the following issues:

  • CVE-2022-35949: Fixed SSRF when an application takes in user input into the path/pathname option of undici.request (bsc#1202382).
  • CVE-2022-35948: Fixed CRLF injection via Content-Type (bsc#1202383).
  • CVE-2022-29244: Fixed npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (bsc#1200517).
  • CVE-2022-31150: Fixed CRLF injection in node-undici (bsc#1201710).

Bugfixes:

  • Enable crypto-policies for SLE15 SP4+ and TW (bsc#1200303)
Record
SUSE-SU-2022:3251-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
undici
npm
 through 5.8.1
5.8.2
undici
TuxCare:npm
From an advisory covering 14 CVEs
 5.5.1-tuxcare.0 up to 5.5.1-tuxcare.1, plus listed versions
5.5.1
5.5.1-tuxcare.1
node-undici
Debian:12
 before 5.8.2+dfsg1+~cs18.9.18.1-1
5.8.2+dfsg1+~cs18.9.18.1-1
node-undici
Debian:13
 before 5.8.2+dfsg1+~cs18.9.18.1-1
5.8.2+dfsg1+~cs18.9.18.1-1
node-undici
Debian:14
 before 5.8.2+dfsg1+~cs18.9.18.1-1
5.8.2+dfsg1+~cs18.9.18.1-1
undici
npm
 before 5.8.2
5.8.2
nodejs16
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 4 CVEs
 before 16.17.0-8.9.1
16.17.0-8.9.1
nodejs16
SUSE:Linux Enterprise Module for Web and Scripting 15 SP4
From an advisory covering 4 CVEs
 before 16.17.0-150400.3.6.1
16.17.0-150400.3.6.1
nodejs16
openSUSE:Leap 15.4
From an advisory covering 4 CVEs
 before 16.17.0-150400.3.6.1
16.17.0-150400.3.6.1
nodejs16
SUSE:Linux Enterprise Module for Web and Scripting 15 SP3
From an advisory covering 4 CVEs
 before 16.17.0-150300.7.9.1
16.17.0-150300.7.9.1
nodejs16
openSUSE:Leap 15.3
From an advisory covering 4 CVEs
 before 16.17.0-150300.7.9.1
16.17.0-150300.7.9.1
nodejs16
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 16.17.0-2.1
16.17.0-2.1

History

History
RecordedChangedSources
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-35949 is a medium vulnerability (CVSS 5.3) in Nodejs Undici, published August 12, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.93%, the 80th percentile. Fixed in undici 5.8.2.

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open