Undici's cookie header not cleared on cross-origin redirect in fetch
Priority LOW 21CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Partial Red Hat: 3 fixed, 5 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.
Summary
Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design, `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01368 72nd percentileScored 2026-11-07
Fix Partial undici (nodejs): 5.26.2undici (npm): 5.26.2Red Hat: 3 advisoriesRed Hat: 3 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NodeJS | undici | before 5.26.2 | 5.26.2 | Patch available | CNA |
| — | undici (npm) | before 5.26.2 | 5.26.2 | Patch available | GHSA-wqq4-5wpv-mx2g |
- undici VendorNodeJS Affected before 5.26.2 Fixed in 5.26.2 Patch available CNA
- undici (npm) Vendor— Affected before 5.26.2 Fixed in 5.26.2 Patch available GHSA-wqq4-5wpv-mx2g
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:* | before 5.26.2 | Vulnerable | NodeJS |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* | 39 | Vulnerable | Fedoraproject |
- cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:* Versions before 5.26.2 Vulnerable ·NodeJS
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA undici (nodejs) Fixed in 5.26.2
- Fix · GHSA-wqq4-5wpv-mx2g undici (npm) Fixed in 5.26.2 Advisory →
Red Hat 3 advisories
- RHSA-2023:7205 Released 2023-11-14 · Red Hat rating Importantnodejs:20 security update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.aarch64::nodejs:20, nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.ppc64le::nodejs:20, nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.s390x::nodejs:20 +20
- RHSA-2023:5869 Released 2023-10-18 · Red Hat rating Importantnodejs:18 security update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:18.18.2-1.module+el8.8.0+20407+c11d40bd.aarch64::nodejs:18, nodejs-1:18.18.2-1.module+el8.8.0+20407+c11d40bd.ppc64le::nodejs:18, nodejs-1:18.18.2-1.module+el8.8.0+20407+c11d40bd.s390x::nodejs:18 +20
- RHSA-2023:5849 Released 2023-10-18 · Red Hat rating Importantnodejs:18 security update
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5.aarch64::nodejs:18, nodejs-1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5.ppc64le::nodejs:18, nodejs-1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5.s390x::nodejs:18 +20
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Serverless | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat Software Collections | Affected | No fix yet: Fix deferred |
| RHDH 1.1 for RHEL 9 | Fixed | — |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2023:5869, RHSA-2023:7205 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:5849 |
Not affected: 2 products
- RHDH 1.1 for RHEL 9
- Red Hat Developer Hub 1
Timeline
- 2026-10-02 Threatist record created from CVE-2023-45143
- 2026-10-03 Alias added: GHSA-wqq4-5wpv-mx2g
- 2026-10-27 Affected versions changed · Red Hat
References
Advisory 8
- https://github.com/nodejs/undici/security/advisories/GHSA-wqq4-5wpv-mx2g
- https://lists.fedoraproject.org/archives/list/[email protected]/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/
- https://nvd.nist.gov/vuln/detail/CVE-2023-45143
Other 10
- https://github.com/nodejs/undici/security/advisories/GHSA-q768-x9m6-m9qp
- https://hackerone.com/reports/2166948
- https://github.com/nodejs/undici/releases/tag/v5.26.2
- https://github.com/nodejs/undici
- https://lists.fedoraproject.org/archives/list/[email protected]/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A
- https://lists.fedoraproject.org/archives/list/[email protected]/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5
- https://lists.fedoraproject.org/archives/list/[email protected]/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU
- https://lists.fedoraproject.org/archives/list/[email protected]/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ
- https://lists.fedoraproject.org/archives/list/[email protected]/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG
- https://lists.fedoraproject.org/archives/list/[email protected]/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y
More NodeJS Undici vulnerabilities
- TI-2026-01215 undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') CVSS 3.1CRITICAL 9.8
- TI-2022-16376 `undici.request` vulnerable to SSRF using absolute URL on `pathname` CVSS 3.1CRITICAL 9.8
- TI-2023-09734 CRLF Injection in Nodejs ‘undici’ via host CVSS 3.1MEDIUM 6.5
- TI-2022-13193 CRLF injection in request headers CVSS 3.1MEDIUM 6.5
- TI-2022-16375 CRLF Injection in Nodejs ‘undici’ via Content-Type CVSS 3.1MEDIUM 5.3
- TI-2022-13194 Uncleared cookies on cross-host/cross-origin redirect in undici CVSS 3.1MEDIUM 6.5
Sources
- CVE-2023-45143 · CVE Program
- CVE-2023-45143 · NVD
- FIRST EPSS
- GHSA-wqq4-5wpv-mx2g · GitHub Advisory Database · CC BY 4.0
- CVE-2023-45143 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences