GHSA-wqq4-5wpv-mx2g

    Dashboard / Vulnerabilities / GHSA-wqq4-5wpv-mx2g

    GHSA-wqq4-5wpv-mx2g

    Published: 16 Oct 2023Last Modified: 4 Feb 2026

    Summary: Undici's cookie header not cleared on cross-origin redirect in fetch

    Details: ### Impact Undici clears Authorization headers on cross-origin redirects, but does not clear `Cookie` headers. By design, `cookie` headers are [forbidden request headers](https://fetch.spec.whatwg.org/#forbidden-request-header), disallowing them to be set in `RequestInit.headers` in browser environments. Since Undici handles headers more liberally than the specification, there was a disconnect from the assumptions the spec made, and Undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site. ### Patches This was patched in [e041de359221ebeae04c469e8aff4145764e6d76](https://github.com/nodejs/undici/commit/e041de359221ebeae04c469e8aff4145764e6d76), which is included in version 5.26.2.

    References: https://github.com/nodejs/undici/security/advisories/GHSA-q768-x9m6-m9qp, https://github.com/nodejs/undici/security/advisories/GHSA-wqq4-5wpv-mx2g, https://nvd.nist.gov/vuln/detail/CVE-2023-45143, https://github.com/nodejs/undici/commit/e041de359221ebeae04c469e8aff4145764e6d76, https://hackerone.com/reports/2166948, https://github.com/nodejs/undici, https://github.com/nodejs/undici/releases/tag/v5.26.2, https://lists.fedoraproject.org/archives/list/[email protected]/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A, https://lists.fedoraproject.org/archives/list/[email protected]/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5, https://lists.fedoraproject.org/archives/list/[email protected]/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU, https://lists.fedoraproject.org/archives/list/[email protected]/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ, https://lists.fedoraproject.org/archives/list/[email protected]/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG, https://lists.fedoraproject.org/archives/list/[email protected]/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y

    Affected packages

    Package

    Name: undici

    Purl: pkg:npm/undici

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -5.26.2

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-wqq4-5wpv-mx2g | CVE-DB