{"id":"CVE-2023-45143","aliases":["ALPINE-CVE-2023-45143","ALSA-2023:5849","ALSA-2023:5869","ALSA-2023:7205","AZL-31338","CLSA-2026-1775220180","CLSA-2026-1788560495","DEBIAN-CVE-2023-45143","EUVD-2023-2832","GHSA-wqq4-5wpv-mx2g","MGASA-2023-0299","RHSA-2023:5849","RHSA-2023:5869","RHSA-2023:7205","RLSA-2023:5849","RLSA-2023:5869","RLSA-2023:7205","SUSE-SU-2023:4132-1","SUSE-SU-2023:4133-1","SUSE-SU-2023:4150-1","SUSE-SU-2023:4155-1","SUSE-SU-2023:4207-1","UBUNTU-CVE-2023-45143","openSUSE-SU-2024:13337-1","openSUSE-SU-2024:13340-1"],"status":"published","title":"Undici's cookie header not cleared on cross-origin redirect in fetch","description":"Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design, `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.","severity":{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01368,"percentile":0.72099,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2023-10-12T16:35:40Z","modified":"2026-10-29T11:30:59Z","fixes":[{"ecosystem":"npm","package":"undici","fixed_in":["5.26.2"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.17","package":"nodejs","fixed_in":["18.18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"nodejs","fixed_in":["18.18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nodejs","fixed_in":["18.18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nodejs","fixed_in":["18.18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs","fixed_in":["18.18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs","fixed_in":["18.18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs","fixed_in":["18.18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs","fixed_in":["18.18.2-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"nodejs18","fixed_in":["18.18.2-2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs","fixed_in":["1:16.20.2-8.el9_6.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-devel","fixed_in":["1:16.20.2-8.el9_6.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-docs","fixed_in":["1:16.20.2-8.el9_6.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-full-i18n","fixed_in":["1:16.20.2-8.el9_6.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-libs","fixed_in":["1:16.20.2-8.el9_6.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"npm","fixed_in":["1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"v8-devel","fixed_in":["2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-undici","fixed_in":["5.15.0+dfsg1+~cs20.10.9.3-1+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-undici","fixed_in":["5.26.3+dfsg1+~cs23.10.12-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-undici","fixed_in":["5.26.3+dfsg1+~cs23.10.12-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.18.2-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-2.module_el9.2.0+43+3ebc9e20"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-2.module_el9.2.0+43+3ebc9e20"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-2.module_el9.2.0+43+3ebc9e20"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-2.module_el9.2.0+43+3ebc9e20"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el9.2.0+36+853e48f5"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.1.0+13+d9a595ea"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.1.0+13+d9a595ea"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.8.1-1.18.18.2.2.module_el9.2.0+43+3ebc9e20"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-1.module_el8.8.0+3652+0e111ba0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-1.module_el8.8.0+3652+0e111ba0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-1.module_el8.8.0+3652+0e111ba0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-1.module_el8.8.0+3652+0e111ba0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el8.8.0+3613+1ed8c91d"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.7.0+3343+ea2b7901"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.7.0+3343+ea2b7901"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.8.1-1.18.18.2.1.module_el8.8.0+3652+0e111ba0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module_el8.9.0+3675+0258a6d9"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module_el8.9.0+3675+0258a6d9"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module_el8.9.0+3675+0258a6d9"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module_el8.9.0+3675+0258a6d9"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el8.9.0+3675+0258a6d9"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.9.0+3684+11b9e959"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.9.0+3684+11b9e959"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.0-1.20.8.1.1.module_el8.9.0+3675+0258a6d9"}]}],"bundled":6},{"source":"osv","ecosystem":"Azure Linux:2","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.18.2-2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"v8-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.1-tuxcare.0"},{"fixed":"5.5.1-tuxcare.1"}]}],"versions":["5.5.1"],"bundled":14},{"source":"osv","ecosystem":"Debian:12","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u2"}]}],"versions":["5.15.0+dfsg1+~cs20.10.9.3-1","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.3+dfsg1+~cs23.10.12-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.3+dfsg1+~cs23.10.12-1"}]}]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.26.2"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.18.2-1.mga9"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:9","package":"yarnpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.19-14.mga9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.2.0.z+19753+58118bc0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.1.0+15718+e52ec601"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.1.0+15718+e52ec601"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.8.1-1.18.18.2.2.module+el9.2.0.z+20408+7cb5fda5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-1.module+el8.8.0+20407+c11d40bd"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-1.module+el8.8.0+20407+c11d40bd"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-1.module+el8.8.0+20407+c11d40bd"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-1.module+el8.8.0+20407+c11d40bd"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-1.module+el8.8.0+20407+c11d40bd"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-1.module+el8.8.0+20407+c11d40bd"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.8.0+19757+8ca87034"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.7.0+15582+19c314fa"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.7.0+15582+19c314fa"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.8.1-1.18.18.2.1.module+el8.8.0+20407+c11d40bd"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.9.0+19519+e25b965a"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.9.0+19519+e25b965a"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.7.0+40017+f0db1785"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.7.0+40018+a011993d"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.7.0+40022+9ecc286c"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.7.0+40022+9ecc286c"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.7.0+40025+0e0cf6b2"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.7.0+40018+a011993d"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.7.0+40017+f0db1785"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1824+532140ee"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1988+437f3d23"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1989+e60144d9"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.9.0+1760+903d54b9"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1989+e60144d9"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1988+437f3d23"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1824+532140ee"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.8.0+1459+02651ab6"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.7.0+1072+5b168780"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.18.2-8.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP4","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.18.2-150400.9.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.18.2-150400.9.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-8.36.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP4","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150400.3.27.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150300.7.30.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150300.7.30.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150300.7.30.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150300.7.30.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150300.7.30.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150300.7.30.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.22.1+dfsg1+~cs20.10.10.2-1ubuntu1","5.26.3+dfsg1+~cs23.10.12-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.8.1-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs-electron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.9.1-2.1"}]}],"bundled":3}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"nodejs","product":"undici"},{"vendor":"undici","product":"undici"}],"references":[{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-wqq4-5wpv-mx2g","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-q768-x9m6-m9qp","tags":["x_refsource_MISC","x_transferred","Not Applicable","advisory","web","report"]},{"url":"https://github.com/nodejs/undici/commit/e041de359221ebeae04c469e8aff4145764e6d76","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://hackerone.com/reports/2166948","tags":["x_refsource_MISC","x_transferred","Permissions Required","web","report"]},{"url":"https://github.com/nodejs/undici/releases/tag/v5.26.2","tags":["x_refsource_MISC","x_transferred","Release Notes","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45143","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wqq4-5wpv-mx2g"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-45143","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5849","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-38552","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39333","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-44487","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45143","tags":["report"]},{"url":"https://bugzilla.redhat.com/2242803","tags":["report"]},{"url":"https://bugzilla.redhat.com/2244104","tags":["report"]},{"url":"https://bugzilla.redhat.com/2244415","tags":["report"]},{"url":"https://bugzilla.redhat.com/2244418","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-5849.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5869","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-5869.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7205","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39331","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39332","tags":["report"]},{"url":"https://bugzilla.redhat.com/2244413","tags":["report"]},{"url":"https://bugzilla.redhat.com/2244414","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-7205.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1775220180.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45143.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-45143","tags":["advisory"]},{"url":"https://github.com/nodejs/undici","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2023-0299.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32403","tags":["report"]},{"url":"https://github.com/nodejs/node/releases/tag/v18.18.2","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v18.18.1","tags":["web"]},{"url":"https://nodejs.org/en/blog/vulnerability/october-2023-security-releases","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/security/vulnerabilities/RHSB-2023-003","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2242803","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244104","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244415","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244418","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5849.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-38552","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38552","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39333","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39333","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-44487","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487","tags":["advisory"]},{"url":"https://github.com/dotnet/announcements/issues/277","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-2102","tags":["advisory"]},{"url":"https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487","tags":["article"]},{"url":"https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45143","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5869.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244413","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244414","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7205.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39331","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39331","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39332","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39332","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:5849","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:5869","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:7205","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234132-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1216190","tags":["report"]},{"url":"https://bugzilla.suse.com/1216205","tags":["report"]},{"url":"https://bugzilla.suse.com/1216272","tags":["report"]},{"url":"https://bugzilla.suse.com/1216273","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-38552","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39333","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45143","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234133-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234150-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234155-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234207-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-45143","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39332","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-45143","title":"Undici's cookie header not cleared on cross-origin redirect in fetch","description":"Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design, `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.","status":"published","published":"2023-10-12T16:35:40.637Z","modified":"2025-02-13T17:13:50.221Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:35:22.984825Z"}],"euvd":[{"id":"EUVD-2023-2832","description":"Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design, `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.","status":"published","published":"2023-10-12T16:35:40Z","modified":"2025-02-13T17:13:50Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low"}],"updated_at":"2026-11-03T00:03:48.562419Z"}],"ghsa":[{"id":"GHSA-wqq4-5wpv-mx2g","title":"Undici's cookie header not cleared on cross-origin redirect in fetch","description":"### Impact\n\nUndici clears Authorization headers on cross-origin redirects, but does not clear `Cookie` headers. By design, `cookie` headers are [forbidden request headers](https://fetch.spec.whatwg.org/#forbidden-request-header), disallowing them to be set in `RequestInit.headers` in browser environments. Since Undici handles headers more liberally than the specification, there was a disconnect from the assumptions the spec made, and Undici's implementation of fetch.\n\nAs such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site.\n\n### Patches\n\nThis was patched in [e041de359221ebeae04c469e8aff4145764e6d76](https://github.com/nodejs/undici/commit/e041de359221ebeae04c469e8aff4145764e6d76), which is included in version 5.26.2.\n","status":"published","published":"2023-10-16T14:05:37Z","modified":"2024-02-16T22:38:40Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:37:38.20753Z"}],"nvd":[{"id":"CVE-2023-45143","description":"Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design, `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.","status":"published","published":"2023-10-12T17:15:10.087Z","modified":"2026-06-17T06:28:18.473Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:08:37.83429Z"}],"osv":[{"id":"ALPINE-CVE-2023-45143","description":"Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design, `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.","status":"published","published":"2023-10-12T17:15:10.087Z","modified":"2026-10-26T17:17:58.645254074Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"AZL-31338","title":"CVE-2023-45143 affecting package nodejs18 for versions less than 18.18.2-2","description":"Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design, `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.","status":"published","published":"2023-10-12T17:15:10Z","modified":"2026-04-21T04:26:18.488831Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"CVE-2023-45143","title":"Undici's cookie header not cleared on cross-origin redirect in fetch","description":"Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design, `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.","status":"published","published":"2023-10-12T16:35:40.637Z","modified":"2026-10-28T02:30:34.668232243Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:33.792101Z"},{"id":"DEBIAN-CVE-2023-45143","description":"Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design, `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.","status":"published","published":"2023-10-12T17:15:10.087Z","modified":"2026-10-26T18:02:07.662920169Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"GHSA-wqq4-5wpv-mx2g","title":"Undici's cookie header not cleared on cross-origin redirect in fetch","description":"### Impact\n\nUndici clears Authorization headers on cross-origin redirects, but does not clear `Cookie` headers. By design, `cookie` headers are [forbidden request headers](https://fetch.spec.whatwg.org/#forbidden-request-header), disallowing them to be set in `RequestInit.headers` in browser environments. Since Undici handles headers more liberally than the specification, there was a disconnect from the assumptions the spec made, and Undici's implementation of fetch.\n\nAs such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site.\n\n### Patches\n\nThis was patched in [e041de359221ebeae04c469e8aff4145764e6d76](https://github.com/nodejs/undici/commit/e041de359221ebeae04c469e8aff4145764e6d76), which is included in version 5.26.2.\n","status":"published","published":"2023-10-16T14:05:37Z","modified":"2026-02-04T02:35:56.28939Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:59.131095Z"},{"id":"RHSA-2023:5849","title":"Red Hat Security Advisory: nodejs:18 security update","status":"published","published":"2024-10-22T01:46:18Z","modified":"2026-10-15T10:05:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2023:5869","title":"Red Hat Security Advisory: nodejs:18 security update","status":"published","published":"2024-10-22T01:46:40Z","modified":"2026-10-15T10:05:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2023:7205","title":"Red Hat Security Advisory: nodejs:20 security update","status":"published","published":"2024-10-22T01:55:14Z","modified":"2026-10-15T10:06:06Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RLSA-2023:5849","title":"Important: nodejs:18 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n\n* nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)\n\n* nodejs: code injection via WebAssembly export names (CVE-2023-39333)\n\n* node-undici: cookie leakage (CVE-2023-45143)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-12-04T09:05:01.515036Z","modified":"2025-12-05T10:02:58.788613Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"RLSA-2023:5869","title":"Important: nodejs:18 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n\nA Rocky Enterprise Software Foundation Security Bulletin which addresses further details about this flaw is available in the References section.\n\n* nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)\n\n* nodejs: code injection via WebAssembly export names (CVE-2023-39333)\n\n* node-undici: cookie leakage (CVE-2023-45143)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-12-04T09:03:04.71689Z","modified":"2025-12-05T10:19:43.557305Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"UBUNTU-CVE-2023-45143","description":"Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design, `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.","status":"published","published":"2023-10-12T17:15:00Z","modified":"2025-09-08T16:56:32Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low"},{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"ALSA-2023:5849","title":"Important: nodejs:18 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n* nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)\n* nodejs: code injection via WebAssembly export names (CVE-2023-39333)\n* node-undici: cookie leakage (CVE-2023-45143)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-10-18T00:00:00Z","modified":"2026-10-29T11:30:59.028596121Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"ALSA-2023:5869","title":"Important: nodejs:18 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n\nA AlmaLinux Security Bulletin which addresses further details about this flaw is available in the References section.\n\n* nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)\n* nodejs: code injection via WebAssembly export names (CVE-2023-39333)\n* node-undici: cookie leakage (CVE-2023-45143)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-10-18T00:00:00Z","modified":"2026-10-29T11:02:19.308971662Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"ALSA-2023:7205","title":"Important: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n* nodejs: permission model improperly protects against path traversal (CVE-2023-39331)\n* nodejs: path traversal through path stored in Uint8Array (CVE-2023-39332)\n* nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)\n* nodejs: code injection via WebAssembly export names (CVE-2023-39333)\n* node-undici: cookie leakage (CVE-2023-45143)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-11-14T00:00:00Z","modified":"2026-10-29T11:02:19.297751752Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"CLSA-2026-1775220180","title":"nodejs: Fix of CVE-2023-45143","description":"- CVE-2023-45143: fix cookie and host header leak on cross-origin redirect in undici","status":"published","published":"2026-04-03T12:43:04Z","modified":"2026-06-01T00:32:46.325661783Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1788560495","title":"TuxCare security update for undici (14 CVEs)","description":"TuxCare rebuilt undici to address 14 CVEs. Fixed in 5.5.1-tuxcare.1.","status":"published","published":"2026-09-04T22:21:35Z","modified":"2026-10-15T09:48:03.135244229Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"MGASA-2023-0299","title":"Updated nodejs packages fix security vulnerabilities","description":"This is a security release. The following CVEs are fixed in this\nrelease:\n\nCVE-2023-44487: nghttp2 Security Release (High)\nCVE-2023-45143: undici Security Release (High)\nCVE-2023-38552: Integrity checks according to policies can be\ncircumvented (Medium)\nCVE-2023-39333: Code injection via WebAssembly export names (Low)\n\nMore detailed information on each of the vulnerabilities can be found in\nOctober 2023 Security Releases blog post.\n","status":"published","published":"2023-10-22T21:04:51Z","modified":"2026-04-16T04:41:39.870706596Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:13337-1","title":"corepack20-20.8.1-1.1 on GA media","description":"These are all security issues fixed in the corepack20-20.8.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:32:33.89781Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:13340-1","title":"nodejs-electron-25.9.1-2.1 on GA media","description":"These are all security issues fixed in the nodejs-electron-25.9.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:15:05.213821Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"RLSA-2023:7205","title":"Important: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n\n* nodejs: permission model improperly protects against path traversal (CVE-2023-39331)\n\n* nodejs: path traversal through path stored in Uint8Array (CVE-2023-39332)\n\n* nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)\n\n* nodejs: code injection via WebAssembly export names (CVE-2023-39333)\n\n* node-undici: cookie leakage (CVE-2023-45143)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-11-28T22:43:02.525343Z","modified":"2026-02-04T09:00:08.753615Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"SUSE-SU-2023:4132-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\n- Update to version 18.18.2\n- CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)\n- CVE-2023-45143: Fixed a cookie leakage in undici. (bsc#1216205)\n- CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented. (bsc#1216272)\n- CVE-2023-39333: Fixed a code injection via WebAssembly export names. (bsc#1216273)\n","status":"published","published":"2023-10-19T10:02:49Z","modified":"2026-02-04T02:54:22.816663Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4133-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\n- Update to version 18.18.2\n- CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)\n- CVE-2023-45143: Fixed a cookie leakage in undici. (bsc#1216205)\n- CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented. (bsc#1216272)\n- CVE-2023-39333: Fixed a code injection via WebAssembly export names. (bsc#1216273)\n","status":"published","published":"2023-10-19T10:03:29Z","modified":"2026-02-04T03:13:19.984469Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4150-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\n- Update to version 18.18.2\n- CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)\n- CVE-2023-45143: Fixed a cookie leakage in undici. (bsc#1216205)\n- CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented. (bsc#1216272)\n- CVE-2023-39333: Fixed a code injection via WebAssembly export names. (bsc#1216273)\n","status":"published","published":"2023-10-20T14:45:56Z","modified":"2026-02-04T02:44:50.424399Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4155-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\n- Update to version 18.18.2\n- CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)\n- CVE-2023-45143: Fixed a cookie leakage in undici. (bsc#1216205)\n- CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented. (bsc#1216272)\n- CVE-2023-39333: Fixed a code injection via WebAssembly export names. (bsc#1216273)\n","status":"published","published":"2023-10-23T07:18:54Z","modified":"2026-02-04T02:57:12.716303Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4207-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\n- Update to version 18.18.2\n- CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)\n- CVE-2023-45143: Fixed a cookie leakage in undici. (bsc#1216205)\n- CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented. (bsc#1216272)\n- CVE-2023-39333: Fixed a code injection via WebAssembly export names. (bsc#1216273)\n","status":"published","published":"2023-10-26T08:24:10Z","modified":"2026-02-04T03:57:36.907355Z","updated_at":"2026-11-02T15:53:53.865042Z"}]}}