TI-2022-13920 Aliases CVE-2022-32210 GHSA-pgw7-wx7w-2w33

Improper certificate validation in https://github.com/nodejs/undici

LOW 29CWE-295Published 2022-07-14 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Spoofing
Confidentiality · integrity · availability: High · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-295.

Summary

`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.

Why it matters now

EPSS 0.00466 40th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix Fixed undici (npm): 5.5.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	https://github.com/nodejs/undici	Fixed in version >= v5.5.1. Vulnerable between v4.8.2 and v5.5.0	—	No fix listed	CNA
—	undici (npm)	4.8.2 to before 5.5.1	5.5.1	Patch available	GHSA-pgw7-wx7w-2w33

https://github.com/nodejs/undici Vendor— Affected Fixed in version >= v5.5.1. Vulnerable between v4.8.2 and v5.5.0 Fixed in — No fix listed CNA
undici (npm) Vendor— Affected 4.8.2 to before 5.5.1 Fixed in 5.5.1 Patch available GHSA-pgw7-wx7w-2w33

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:nodejs:undici::::::node.js::*	4.8.2 to before 5.5.1	Vulnerable	NodeJS

cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:* Versions 4.8.2 to before 5.5.1 Vulnerable ·NodeJS

Remediation

Fix · GHSA-pgw7-wx7w-2w33 undici (npm) Fixed in 5.5.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-32210
2026-10-03 Alias added: GHSA-pgw7-wx7w-2w33

References

Exploit 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2022-32210

Other 1

https://github.com/nodejs/undici

TI-2026-01215 undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') CVSS 3.1CRITICAL 9.8
TI-2022-16376 `undici.request` vulnerable to SSRF using absolute URL on `pathname` CVSS 3.1CRITICAL 9.8
TI-2023-09734 CRLF Injection in Nodejs ‘undici’ via host CVSS 3.1MEDIUM 6.5
TI-2022-13193 CRLF injection in request headers CVSS 3.1MEDIUM 6.5
TI-2022-16375 CRLF Injection in Nodejs ‘undici’ via Content-Type CVSS 3.1MEDIUM 5.3
TI-2022-13194 Uncleared cookies on cross-host/cross-origin redirect in undici CVSS 3.1MEDIUM 6.5

See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences