CVE-2022-32210: Undici ProxyAgent MITM Vulnerability
Summary
CVE-2022-32210: ProxyAgent vulnerable to MITM. Affects undici versions >= 4.8.2, < 5.5.1. Fixed in 5.5.1. How to fix ↓
Also tracked for
- node-undici · Debian:12
The same CVE-2022-32210 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Undici is an HTTP/1.1 client library for Node.js that provides a high-performance, low-memory footprint alternative to Node's built-in HTTP module. It allows users to make HTTP requests and supports features like connection pooling, pipelining, and request cancellation. The ProxyAgent module in Undici is responsible for handling requests via HTTP proxies. However, a vulnerability in the ProxyAgent module allows for Man-in-the-Middle (MITM) attacks on HTTPS traffic.
Vulnerability Detail
The vulnerability in Undici's ProxyAgent module arises from the fact that it does not verify the remote server's certificate when making HTTPS requests via an HTTP proxy. This means that all request and response data is exposed to the proxy, enabling an attacker on the network path to intercept and modify the traffic. Additionally, if the proxy's URL is HTTP, even nominally HTTPS requests are sent as plain-text HTTP between Undici and the proxy server. The impact of this vulnerability is significant as it removes all HTTPS security from requests made using Undici's ProxyAgent, allowing for easy MITM attacks by anyone on the network path.
How To Fix
Latest published version: 8.12.3 as of 22 Oct 2026
npm install undici@8.12.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.5.1
This is the first release that contains the fix.
npm install undici@5.5.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
At present, there is no known workaround for this vulnerability. The only solution is to update the Undici package to a version that includes the fix.
Conclusion
The vulnerability in Undici's ProxyAgent module exposes HTTPS traffic to Man-in-the-Middle (MITM) attacks, compromising the security of the requests made using Undici. To address this vulnerability, it is crucial to update the Undici package to version 5.5.1 or later. This update ensures that the ProxyAgent module verifies the remote server's certificate, preventing unauthorized interception and modification of the traffic. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for undici →
FAQ
The vulnerability allows for Man-in-the-Middle (MITM) attacks on HTTPS traffic. It removes all HTTPS security from requests made using Undici's ProxyAgent, enabling an attacker on the network path to intercept and modify the traffic.
No, the vulnerability affects Undici versions up to and including 5.5.0. Updating to version 5.5.1 or later will address the issue.
HTTPS requests via HTTPS proxies are less seriously affected. While the proxy can view and modify all HTTPS traffic, the vulnerability only allows the proxy to do so. Other entities on the network path cannot perform MITM attacks.
No, at present, the only solution is to update the Undici package to a version that includes the fix.
You can find more information about the vulnerability in the GitHub Advisory Database. The vulnerability is tracked under the identifier GHSA-pgw7-wx7w-2w33.
Related vulnerabilities
Recent vulnerabilities recorded for undici.
