p PatchFirst

PatchFirst · Latest vulnerabilities

node-undici vulnerabilities · Page 3

Vulnerabilities published for node-undici in the last 30 days: 7. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 42

  1. CVE-2022-31150

    Medium · CVSS 5.3EPSS 1.52%Fix available

    CRLF injection in request headers

    undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate `\r\n` is a workaround for this issue.

    node-undiciOperating systems
    • Update to 5.8.0+dfsg1+~cs18.9.16-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2022-32210

    High · CVSS 7.7EPSS 0.47%Fix available

    CVE-2022-32210

    `Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.

    node-undiciOperating systems
    • Update to 5.6.1+dfsg1+~cs18.9.16-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →