CVE-2023-45143
Undici's cookie header not cleared on cross-origin redirect in fetch
Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear Cookie headers. By design, cookie headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Undici's cookie header not cleared on cross-origin redirect in fetch
Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear Cookie headers. By design, cookie headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.
- Record
CVE-2023-45143- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2023-2832
Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear Cookie headers. By design, cookie headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.
- Record
EUVD-2023-2832- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wqq4-5wpv-mx2g
Undici's cookie header not cleared on cross-origin redirect in fetch
Impact
Undici clears Authorization headers on cross-origin redirects, but does not clear Cookie headers. By design, cookie headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since Undici handles headers more liberally than the specification, there was a disconnect from the assumptions the spec made, and Undici's implementation of fetch.
As such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site.
Patches
This was patched in e041de359221ebeae04c469e8aff4145764e6d76, which is included in version 5.26.2.
- Record
GHSA-wqq4-5wpv-mx2g- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-200
- Updated
- 2026-11-02
NVD
Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear Cookie headers. By design, cookie headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.
- Record
CVE-2023-45143- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L - CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVALPINE-CVE-2023-45143
Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear Cookie headers. By design, cookie headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.
- Record
ALPINE-CVE-2023-45143- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVAZL-31338
CVE-2023-45143 affecting package nodejs18 for versions less than 18.18.2-2
Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear Cookie headers. By design, cookie headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.
- Record
AZL-31338- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 23 moreShow less
OSV
Undici's cookie header not cleared on cross-origin redirect in fetch
Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear Cookie headers. By design, cookie headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.
- Record
CVE-2023-45143- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-45143
Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear Cookie headers. By design, cookie headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.
- Record
DEBIAN-CVE-2023-45143- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-wqq4-5wpv-mx2g
Undici's cookie header not cleared on cross-origin redirect in fetch
Impact
Undici clears Authorization headers on cross-origin redirects, but does not clear Cookie headers. By design, cookie headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since Undici handles headers more liberally than the specification, there was a disconnect from the assumptions the spec made, and Undici's implementation of fetch.
As such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site.
Patches
This was patched in e041de359221ebeae04c469e8aff4145764e6d76, which is included in version 5.26.2.
- Record
GHSA-wqq4-5wpv-mx2g- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVRHSA-2023:5849
Red Hat Security Advisory: nodejs:18 security update
- Record
RHSA-2023:5849- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2023:5869
Red Hat Security Advisory: nodejs:18 security update
- Record
RHSA-2023:5869- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2023:7205
Red Hat Security Advisory: nodejs:20 security update
- Record
RHSA-2023:7205- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2023:5849
Important: nodejs:18 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
-
HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
-
nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)
-
nodejs: code injection via WebAssembly export names (CVE-2023-39333)
-
node-undici: cookie leakage (CVE-2023-45143)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2023:5849- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVRLSA-2023:5869
Important: nodejs:18 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
- HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
A Rocky Enterprise Software Foundation Security Bulletin which addresses further details about this flaw is available in the References section.
-
nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)
-
nodejs: code injection via WebAssembly export names (CVE-2023-39333)
-
node-undici: cookie leakage (CVE-2023-45143)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2023:5869- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-45143
Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear Cookie headers. By design, cookie headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.
- Record
UBUNTU-CVE-2023-45143- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L - CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVALSA-2023:5849 No score
Important: nodejs:18 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
- HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
- nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)
- nodejs: code injection via WebAssembly export names (CVE-2023-39333)
- node-undici: cookie leakage (CVE-2023-45143)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2023:5849- Updated
- 2026-11-02
OSVALSA-2023:5869 No score
Important: nodejs:18 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
- HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
A AlmaLinux Security Bulletin which addresses further details about this flaw is available in the References section.
- nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)
- nodejs: code injection via WebAssembly export names (CVE-2023-39333)
- node-undici: cookie leakage (CVE-2023-45143)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2023:5869- Updated
- 2026-11-02
OSVALSA-2023:7205 No score
Important: nodejs:20 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
- HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
- nodejs: permission model improperly protects against path traversal (CVE-2023-39331)
- nodejs: path traversal through path stored in Uint8Array (CVE-2023-39332)
- nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)
- nodejs: code injection via WebAssembly export names (CVE-2023-39333)
- node-undici: cookie leakage (CVE-2023-45143)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2023:7205- Updated
- 2026-11-02
OSVCLSA-2026-1775220180 No score
nodejs: Fix of CVE-2023-45143
- CVE-2023-45143: fix cookie and host header leak on cross-origin redirect in undici
- Record
CLSA-2026-1775220180- Updated
- 2026-11-02
OSVCLSA-2026-1788560495 No score
TuxCare security update for undici (14 CVEs)
TuxCare rebuilt undici to address 14 CVEs. Fixed in 5.5.1-tuxcare.1.
- Record
CLSA-2026-1788560495- Updated
- 2026-11-02
OSVMGASA-2023-0299 No score
Updated nodejs packages fix security vulnerabilities
This is a security release. The following CVEs are fixed in this release:
CVE-2023-44487: nghttp2 Security Release (High) CVE-2023-45143: undici Security Release (High) CVE-2023-38552: Integrity checks according to policies can be circumvented (Medium) CVE-2023-39333: Code injection via WebAssembly export names (Low)
More detailed information on each of the vulnerabilities can be found in October 2023 Security Releases blog post.
- Record
MGASA-2023-0299- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13337-1 No score
corepack20-20.8.1-1.1 on GA media
These are all security issues fixed in the corepack20-20.8.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13337-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13340-1 No score
nodejs-electron-25.9.1-2.1 on GA media
These are all security issues fixed in the nodejs-electron-25.9.1-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13340-1- Updated
- 2026-11-02
OSVRLSA-2023:7205 No score
Important: nodejs:20 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
-
HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
-
nodejs: permission model improperly protects against path traversal (CVE-2023-39331)
-
nodejs: path traversal through path stored in Uint8Array (CVE-2023-39332)
-
nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)
-
nodejs: code injection via WebAssembly export names (CVE-2023-39333)
-
node-undici: cookie leakage (CVE-2023-45143)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2023:7205- Updated
- 2026-11-02
OSVSUSE-SU-2023:4132-1 No score
Security update for nodejs18
This update for nodejs18 fixes the following issues:
- Update to version 18.18.2
- CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)
- CVE-2023-45143: Fixed a cookie leakage in undici. (bsc#1216205)
- CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented. (bsc#1216272)
- CVE-2023-39333: Fixed a code injection via WebAssembly export names. (bsc#1216273)
- Record
SUSE-SU-2023:4132-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:4133-1 No score
Security update for nodejs18
This update for nodejs18 fixes the following issues:
- Update to version 18.18.2
- CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)
- CVE-2023-45143: Fixed a cookie leakage in undici. (bsc#1216205)
- CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented. (bsc#1216272)
- CVE-2023-39333: Fixed a code injection via WebAssembly export names. (bsc#1216273)
- Record
SUSE-SU-2023:4133-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:4150-1 No score
Security update for nodejs18
This update for nodejs18 fixes the following issues:
- Update to version 18.18.2
- CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)
- CVE-2023-45143: Fixed a cookie leakage in undici. (bsc#1216205)
- CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented. (bsc#1216272)
- CVE-2023-39333: Fixed a code injection via WebAssembly export names. (bsc#1216273)
- Record
SUSE-SU-2023:4150-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:4155-1 No score
Security update for nodejs18
This update for nodejs18 fixes the following issues:
- Update to version 18.18.2
- CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)
- CVE-2023-45143: Fixed a cookie leakage in undici. (bsc#1216205)
- CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented. (bsc#1216272)
- CVE-2023-39333: Fixed a code injection via WebAssembly export names. (bsc#1216273)
- Record
SUSE-SU-2023:4155-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:4207-1 No score
Security update for nodejs18
This update for nodejs18 fixes the following issues:
- Update to version 18.18.2
- CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)
- CVE-2023-45143: Fixed a cookie leakage in undici. (bsc#1216205)
- CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented. (bsc#1216272)
- CVE-2023-39333: Fixed a code injection via WebAssembly export names. (bsc#1216273)
- Record
SUSE-SU-2023:4207-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
undicinpm |
before 5.26.2 | 5.26.2 |
nodejsAlpine:v3.17 |
before 18.18.2-r0 | 18.18.2-r0 |
nodejsAlpine:v3.18 |
before 18.18.2-r0 | 18.18.2-r0 |
nodejsAlpine:v3.19 |
before 18.18.2-r0 | 18.18.2-r0 |
nodejsAlpine:v3.20 |
before 18.18.2-r0 | 18.18.2-r0 |
nodejsAlpine:v3.21 |
before 18.18.2-r0 | 18.18.2-r0 |
nodejsAlpine:v3.22 |
before 18.18.2-r0 | 18.18.2-r0 |
nodejsAlpine:v3.23 |
before 18.18.2-r0 | 18.18.2-r0 |
nodejsAlpine:v3.24 |
before 18.18.2-r0 | 18.18.2-r0 |
nodejsAlmaLinux:9 From an advisory covering 4 CVEs |
before 1:18.18.2-2.module_el9.2.0+43+3ebc9e20 | 1:18.18.2-2.module_el9.2.0+43+3ebc9e20 |
Show 97 moreShow less
| Package | Affected | Fixed |
|---|---|---|
nodejs-develAlmaLinux:9 From an advisory covering 4 CVEs |
before 1:18.18.2-2.module_el9.2.0+43+3ebc9e20 | 1:18.18.2-2.module_el9.2.0+43+3ebc9e20 |
nodejs-docsAlmaLinux:9 From an advisory covering 4 CVEs |
before 1:18.18.2-2.module_el9.2.0+43+3ebc9e20 | 1:18.18.2-2.module_el9.2.0+43+3ebc9e20 |
nodejs-full-i18nAlmaLinux:9 From an advisory covering 4 CVEs |
before 1:18.18.2-2.module_el9.2.0+43+3ebc9e20 | 1:18.18.2-2.module_el9.2.0+43+3ebc9e20 |
nodejs-nodemonAlmaLinux:9 From an advisory covering 4 CVEs |
before 3.0.1-1.module_el9.2.0+36+853e48f5 | 3.0.1-1.module_el9.2.0+36+853e48f5 |
nodejs-packagingAlmaLinux:9 From an advisory covering 4 CVEs |
before 2021.06-4.module_el9.1.0+13+d9a595ea | 2021.06-4.module_el9.1.0+13+d9a595ea |
nodejs-packaging-bundlerAlmaLinux:9 From an advisory covering 4 CVEs |
before 2021.06-4.module_el9.1.0+13+d9a595ea | 2021.06-4.module_el9.1.0+13+d9a595ea |
npmAlmaLinux:9 From an advisory covering 4 CVEs |
before 1:9.8.1-1.18.18.2.2.module_el9.2.0+43+3ebc9e20 | 1:9.8.1-1.18.18.2.2.module_el9.2.0+43+3ebc9e20 |
nodejsAlmaLinux:8 From an advisory covering 4 CVEs |
before 1:18.18.2-1.module_el8.8.0+3652+0e111ba0 | 1:18.18.2-1.module_el8.8.0+3652+0e111ba0 |
nodejs-develAlmaLinux:8 From an advisory covering 4 CVEs |
before 1:18.18.2-1.module_el8.8.0+3652+0e111ba0 | 1:18.18.2-1.module_el8.8.0+3652+0e111ba0 |
nodejs-docsAlmaLinux:8 From an advisory covering 4 CVEs |
before 1:18.18.2-1.module_el8.8.0+3652+0e111ba0 | 1:18.18.2-1.module_el8.8.0+3652+0e111ba0 |
nodejs-full-i18nAlmaLinux:8 From an advisory covering 4 CVEs |
before 1:18.18.2-1.module_el8.8.0+3652+0e111ba0 | 1:18.18.2-1.module_el8.8.0+3652+0e111ba0 |
nodejs-nodemonAlmaLinux:8 From an advisory covering 4 CVEs |
before 3.0.1-1.module_el8.8.0+3613+1ed8c91d | 3.0.1-1.module_el8.8.0+3613+1ed8c91d |
nodejs-packagingAlmaLinux:8 From an advisory covering 4 CVEs |
before 2021.06-4.module_el8.7.0+3343+ea2b7901 | 2021.06-4.module_el8.7.0+3343+ea2b7901 |
nodejs-packaging-bundlerAlmaLinux:8 From an advisory covering 4 CVEs |
before 2021.06-4.module_el8.7.0+3343+ea2b7901 | 2021.06-4.module_el8.7.0+3343+ea2b7901 |
npmAlmaLinux:8 From an advisory covering 4 CVEs |
before 1:9.8.1-1.18.18.2.1.module_el8.8.0+3652+0e111ba0 | 1:9.8.1-1.18.18.2.1.module_el8.8.0+3652+0e111ba0 |
nodejsAlmaLinux:8 From an advisory covering 6 CVEs |
before 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 |
nodejs-develAlmaLinux:8 From an advisory covering 6 CVEs |
before 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 |
nodejs-docsAlmaLinux:8 From an advisory covering 6 CVEs |
before 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 |
nodejs-full-i18nAlmaLinux:8 From an advisory covering 6 CVEs |
before 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 |
nodejs-nodemonAlmaLinux:8 From an advisory covering 6 CVEs |
before 3.0.1-1.module_el8.9.0+3675+0258a6d9 | 3.0.1-1.module_el8.9.0+3675+0258a6d9 |
nodejs-packagingAlmaLinux:8 From an advisory covering 6 CVEs |
before 2021.06-4.module_el8.9.0+3684+11b9e959 | 2021.06-4.module_el8.9.0+3684+11b9e959 |
nodejs-packaging-bundlerAlmaLinux:8 From an advisory covering 6 CVEs |
before 2021.06-4.module_el8.9.0+3684+11b9e959 | 2021.06-4.module_el8.9.0+3684+11b9e959 |
npmAlmaLinux:8 From an advisory covering 6 CVEs |
before 1:10.1.0-1.20.8.1.1.module_el8.9.0+3675+0258a6d9 | 1:10.1.0-1.20.8.1.1.module_el8.9.0+3675+0258a6d9 |
nodejs18Azure Linux:2 |
before 18.18.2-2 | 18.18.2-2 |
nodejsTuxCare:AlmaLinux:9.6 |
before 1:16.20.2-8.el9_6.tuxcare.els10 | 1:16.20.2-8.el9_6.tuxcare.els10 |
nodejs-develTuxCare:AlmaLinux:9.6 |
before 1:16.20.2-8.el9_6.tuxcare.els10 | 1:16.20.2-8.el9_6.tuxcare.els10 |
nodejs-docsTuxCare:AlmaLinux:9.6 |
before 1:16.20.2-8.el9_6.tuxcare.els10 | 1:16.20.2-8.el9_6.tuxcare.els10 |
nodejs-full-i18nTuxCare:AlmaLinux:9.6 |
before 1:16.20.2-8.el9_6.tuxcare.els10 | 1:16.20.2-8.el9_6.tuxcare.els10 |
nodejs-libsTuxCare:AlmaLinux:9.6 |
before 1:16.20.2-8.el9_6.tuxcare.els10 | 1:16.20.2-8.el9_6.tuxcare.els10 |
npmTuxCare:AlmaLinux:9.6 |
before 1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els10 | 1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els10 |
v8-develTuxCare:AlmaLinux:9.6 |
before 2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els10 | 2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els10 |
undiciTuxCare:npm From an advisory covering 14 CVEs |
5.5.1-tuxcare.0 up to 5.5.1-tuxcare.1, plus listed versions 5.5.1 |
5.5.1-tuxcare.1 |
node-undiciDebian:12 |
before 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u2, plus listed versions 5.15.0+dfsg1+~cs20.10.9.3-15.15.0+dfsg1+~cs20.10.9.3-1+deb12u1 |
5.15.0+dfsg1+~cs20.10.9.3-1+deb12u2 |
node-undiciDebian:13 |
before 5.26.3+dfsg1+~cs23.10.12-1 | 5.26.3+dfsg1+~cs23.10.12-1 |
node-undiciDebian:14 |
before 5.26.3+dfsg1+~cs23.10.12-1 | 5.26.3+dfsg1+~cs23.10.12-1 |
nodejsMageia:9 From an advisory covering 4 CVEs |
before 18.18.2-1.mga9 | 18.18.2-1.mga9 |
yarnpkgMageia:9 From an advisory covering 4 CVEs |
before 1.22.19-14.mga9 | 1.22.19-14.mga9 |
nodejsRed Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs |
before 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5 | 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5 |
nodejs-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs |
before 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5 | 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5 |
nodejs-debugsourceRed Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs |
before 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5 | 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5 |
nodejs-develRed Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs |
before 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5 | 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5 |
nodejs-docsRed Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs |
before 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5 | 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5 |
nodejs-full-i18nRed Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs |
before 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5 | 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5 |
nodejs-nodemonRed Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs |
before 0:3.0.1-1.module+el9.2.0.z+19753+58118bc0 | 0:3.0.1-1.module+el9.2.0.z+19753+58118bc0 |
nodejs-packagingRed Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs |
before 0:2021.06-4.module+el9.1.0+15718+e52ec601 | 0:2021.06-4.module+el9.1.0+15718+e52ec601 |
nodejs-packaging-bundlerRed Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs |
before 0:2021.06-4.module+el9.1.0+15718+e52ec601 | 0:2021.06-4.module+el9.1.0+15718+e52ec601 |
npmRed Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs |
before 1:9.8.1-1.18.18.2.2.module+el9.2.0.z+20408+7cb5fda5 | 1:9.8.1-1.18.18.2.2.module+el9.2.0.z+20408+7cb5fda5 |
nodejsRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 1:18.18.2-1.module+el8.8.0+20407+c11d40bd | 1:18.18.2-1.module+el8.8.0+20407+c11d40bd |
nodejs-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 1:18.18.2-1.module+el8.8.0+20407+c11d40bd | 1:18.18.2-1.module+el8.8.0+20407+c11d40bd |
nodejs-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 1:18.18.2-1.module+el8.8.0+20407+c11d40bd | 1:18.18.2-1.module+el8.8.0+20407+c11d40bd |
nodejs-develRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 1:18.18.2-1.module+el8.8.0+20407+c11d40bd | 1:18.18.2-1.module+el8.8.0+20407+c11d40bd |
nodejs-docsRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 1:18.18.2-1.module+el8.8.0+20407+c11d40bd | 1:18.18.2-1.module+el8.8.0+20407+c11d40bd |
nodejs-full-i18nRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 1:18.18.2-1.module+el8.8.0+20407+c11d40bd | 1:18.18.2-1.module+el8.8.0+20407+c11d40bd |
nodejs-nodemonRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 0:3.0.1-1.module+el8.8.0+19757+8ca87034 | 0:3.0.1-1.module+el8.8.0+19757+8ca87034 |
nodejs-packagingRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 0:2021.06-4.module+el8.7.0+15582+19c314fa | 0:2021.06-4.module+el8.7.0+15582+19c314fa |
nodejs-packaging-bundlerRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 0:2021.06-4.module+el8.7.0+15582+19c314fa | 0:2021.06-4.module+el8.7.0+15582+19c314fa |
npmRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 1:9.8.1-1.18.18.2.1.module+el8.8.0+20407+c11d40bd | 1:9.8.1-1.18.18.2.1.module+el8.8.0+20407+c11d40bd |
nodejsRed Hat:enterprise_linux:8::appstream From an advisory covering 6 CVEs |
before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 |
nodejs-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 6 CVEs |
before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 |
nodejs-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 6 CVEs |
before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 |
nodejs-develRed Hat:enterprise_linux:8::appstream From an advisory covering 6 CVEs |
before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 |
nodejs-docsRed Hat:enterprise_linux:8::appstream From an advisory covering 6 CVEs |
before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 |
nodejs-full-i18nRed Hat:enterprise_linux:8::appstream From an advisory covering 6 CVEs |
before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 |
nodejs-nodemonRed Hat:enterprise_linux:8::appstream From an advisory covering 6 CVEs |
before 0:3.0.1-1.module+el8.9.0+20473+c4e3d824 | 0:3.0.1-1.module+el8.9.0+20473+c4e3d824 |
nodejs-packagingRed Hat:enterprise_linux:8::appstream From an advisory covering 6 CVEs |
before 0:2021.06-4.module+el8.9.0+19519+e25b965a | 0:2021.06-4.module+el8.9.0+19519+e25b965a |
nodejs-packaging-bundlerRed Hat:enterprise_linux:8::appstream From an advisory covering 6 CVEs |
before 0:2021.06-4.module+el8.9.0+19519+e25b965a | 0:2021.06-4.module+el8.9.0+19519+e25b965a |
npmRed Hat:enterprise_linux:8::appstream From an advisory covering 6 CVEs |
before 1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824 | 1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824 |
nodejs-nodemonRocky Linux:9 From an advisory covering 4 CVEs |
before 0:3.0.1-1.module+el9.7.0+40017+f0db1785 | 0:3.0.1-1.module+el9.7.0+40017+f0db1785 |
nodejs-nodemonRocky Linux:9 From an advisory covering 4 CVEs |
before 0:3.0.1-1.module+el9.7.0+40018+a011993d | 0:3.0.1-1.module+el9.7.0+40018+a011993d |
nodejs-nodemonRocky Linux:9 From an advisory covering 4 CVEs |
before 0:3.0.1-1.module+el9.7.0+40022+9ecc286c | 0:3.0.1-1.module+el9.7.0+40022+9ecc286c |
nodejs-packagingRocky Linux:9 From an advisory covering 4 CVEs |
before 0:2021.06-4.module+el9.7.0+40022+9ecc286c | 0:2021.06-4.module+el9.7.0+40022+9ecc286c |
nodejs-packagingRocky Linux:9 From an advisory covering 4 CVEs |
before 0:2021.06-4.module+el9.7.0+40025+0e0cf6b2 | 0:2021.06-4.module+el9.7.0+40025+0e0cf6b2 |
nodejs-packagingRocky Linux:9 From an advisory covering 4 CVEs |
before 0:2021.06-4.module+el9.7.0+40018+a011993d | 0:2021.06-4.module+el9.7.0+40018+a011993d |
nodejs-packagingRocky Linux:9 From an advisory covering 4 CVEs |
before 0:2021.06-4.module+el9.7.0+40017+f0db1785 | 0:2021.06-4.module+el9.7.0+40017+f0db1785 |
nodejs-nodemonRocky Linux:8 From an advisory covering 4 CVEs |
before 0:3.0.1-1.module+el8.10.0+1824+532140ee | 0:3.0.1-1.module+el8.10.0+1824+532140ee |
nodejs-nodemonRocky Linux:8 From an advisory covering 4 CVEs |
before 0:3.0.1-1.module+el8.10.0+1988+437f3d23 | 0:3.0.1-1.module+el8.10.0+1988+437f3d23 |
nodejs-nodemonRocky Linux:8 From an advisory covering 4 CVEs |
before 0:3.0.1-1.module+el8.10.0+1989+e60144d9 | 0:3.0.1-1.module+el8.10.0+1989+e60144d9 |
nodejs-nodemonRocky Linux:8 From an advisory covering 4 CVEs |
before 0:3.0.1-1.module+el8.9.0+1760+903d54b9 | 0:3.0.1-1.module+el8.9.0+1760+903d54b9 |
nodejs-packagingRocky Linux:8 From an advisory covering 4 CVEs |
before 0:2021.06-4.module+el8.10.0+1989+e60144d9 | 0:2021.06-4.module+el8.10.0+1989+e60144d9 |
nodejs-packagingRocky Linux:8 From an advisory covering 4 CVEs |
before 0:2021.06-4.module+el8.10.0+1988+437f3d23 | 0:2021.06-4.module+el8.10.0+1988+437f3d23 |
nodejs-packagingRocky Linux:8 From an advisory covering 4 CVEs |
before 0:2021.06-4.module+el8.10.0+1824+532140ee | 0:2021.06-4.module+el8.10.0+1824+532140ee |
nodejs-nodemonRocky Linux:8 From an advisory covering 6 CVEs |
before 0:3.0.1-1.module+el8.8.0+1459+02651ab6 | 0:3.0.1-1.module+el8.8.0+1459+02651ab6 |
nodejs-packagingRocky Linux:8 From an advisory covering 6 CVEs |
before 0:2021.06-4.module+el8.7.0+1072+5b168780 | 0:2021.06-4.module+el8.7.0+1072+5b168780 |
nodejs18SUSE:Linux Enterprise Module for Web and Scripting 12 From an advisory covering 4 CVEs |
before 18.18.2-8.15.1 | 18.18.2-8.15.1 |
nodejs18SUSE:Linux Enterprise Module for Web and Scripting 15 SP4 From an advisory covering 4 CVEs |
before 18.18.2-150400.9.15.1 | 18.18.2-150400.9.15.1 |
nodejs18SUSE:Linux Enterprise Module for Web and Scripting 15 SP5 From an advisory covering 4 CVEs |
before 18.18.2-150400.9.15.1 | 18.18.2-150400.9.15.1 |
nodejs16SUSE:Linux Enterprise Module for Web and Scripting 12 From an advisory covering 4 CVEs |
before 16.20.2-8.36.1 | 16.20.2-8.36.1 |
nodejs16SUSE:Linux Enterprise Module for Web and Scripting 15 SP4 From an advisory covering 4 CVEs |
before 16.20.2-150400.3.27.2 | 16.20.2-150400.3.27.2 |
nodejs16SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS From an advisory covering 4 CVEs |
before 16.20.2-150300.7.30.1 | 16.20.2-150300.7.30.1 |
nodejs16SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 4 CVEs |
before 16.20.2-150300.7.30.1 | 16.20.2-150300.7.30.1 |
nodejs16SUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 4 CVEs |
before 16.20.2-150300.7.30.1 | 16.20.2-150300.7.30.1 |
nodejs16SUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 4 CVEs |
before 16.20.2-150300.7.30.1 | 16.20.2-150300.7.30.1 |
nodejs16SUSE:Manager Server 4.2 From an advisory covering 4 CVEs |
before 16.20.2-150300.7.30.1 | 16.20.2-150300.7.30.1 |
nodejs16SUSE:Enterprise Storage 7.1 From an advisory covering 4 CVEs |
before 16.20.2-150300.7.30.1 | 16.20.2-150300.7.30.1 |
node-undiciUbuntu:24.04:LTS |
All versions, plus listed versions 5.22.1+dfsg1+~cs20.10.10.2-1ubuntu15.26.3+dfsg1+~cs23.10.12-2 |
None known |
nodejs20openSUSE:Tumbleweed From an advisory covering 6 CVEs |
before 20.8.1-1.1 | 20.8.1-1.1 |
nodejs-electronopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 25.9.1-2.1 | 25.9.1-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-45143 is a low vulnerability (CVSS 3.9) in Nodejs Undici, published October 12, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.37%, the 72nd percentile. Fixed in undici 5.26.2.
References
github.com/nodejs/undici/security/advisories/GHSA-wqq4-5wpv-mx2g
hackerone.com/reports/2166948
lists.fedoraproject.org/archives/list/[email protected]/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5
Show 81 moreShow less
nvd.nist.gov/vuln/detail/CVE-2023-45143
security.alpinelinux.org/vuln/CVE-2023-45143
access.redhat.com/errata/RHSA-2023:5849
bugzilla.redhat.com/2242803
errata.almalinux.org/9/ALSA-2023-5849.html
errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1775220180.html
security-tracker.debian.org/tracker/CVE-2023-45143
advisories.mageia.org/MGASA-2023-0299.html
bugs.mageia.org/show_bug.cgi?id=32403
nodejs.org/en/blog/vulnerability/october-2023-security-releases
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5849.json
cve.org/CVERecord?id=CVE-2023-38552
pkg.go.dev/vuln/GO-2023-2102
cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487
nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products
errata.rockylinux.org/RLSA-2023:5849
suse.com/support/update/announcement/2023/suse-su-20234132-1
bugzilla.suse.com/1216190
ubuntu.com/security/CVE-2023-45143