p PatchFirst

CVE-2022-32210

CVE-2022-32210

This page contains facts from public vulnerability sources. Check the original advisory before updating.

`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.

CVSS 7.7 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • https://github.com/nodejs/undici

    Versions
    • Fixed in version >= v5.5.1. Vulnerable between v4.8.2 and v5.5.0: Affected

    No fix published

  • node-undici Debian:12

    Affected ranges
    • ECOSYSTEM: < 5.6.1+dfsg1+~cs18.9.16-1

    Update to 5.6.1+dfsg1+~cs18.9.16-1

  • node-undici Debian:13

    Affected ranges
    • ECOSYSTEM: < 5.6.1+dfsg1+~cs18.9.16-1

    Update to 5.6.1+dfsg1+~cs18.9.16-1

  • node-undici Debian:14

    Affected ranges
    • ECOSYSTEM: < 5.6.1+dfsg1+~cs18.9.16-1

    Update to 5.6.1+dfsg1+~cs18.9.16-1

  • undici npm

    Affected ranges
    • SEMVER: ≥ 4.8.2, < 5.5.1

    Update to 5.5.1

Original sources

Check your server →