Undici - Cookie Header Leakage on Cross-Origin Redirect in Fetch
Summary
CVE-2023-45143: Undici's cookie header not cleared on cross-origin redirect in fetch. Affects undici versions < 5.26.2. Fixed in 5.26.2. How to fix ↓
Also tracked for
- nodejs · Alpine:v3.17
The same CVE-2023-45143 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Undici is an open-source HTTP/1.1 client implementation for Node.js. It provides a low-level API for making HTTP requests and is widely used in various Node.js applications. However, a vulnerability has been discovered in Undici's handling of the Cookie header during cross-origin redirects in the fetch function.
Vulnerability Detail
The vulnerability in Undici allows the Cookie header to be leaked to a third-party site or a malicious attacker who can control the redirection target. While Undici clears the Authorization headers on cross-origin redirects as per the specification, it fails to clear the Cookie headers. This behavior deviates from the specification, which forbids the setting of Cookie headers in the RequestInit.headers in browser environments. As a result, there is a risk of accidental leakage of cookies to unauthorized parties.
How To Fix
Latest published version: 8.12.3 as of 22 Oct 2026
npm install undici@8.12.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.26.2
This is the first release that contains the fix.
npm install undici@5.26.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the Undici package to the patched version as soon as possible.
Conclusion
Undici's vulnerability regarding the leakage of the Cookie header on cross-origin redirects has been addressed in version 5.26.2. It is crucial for developers to update their Undici dependency to this version or later to mitigate the risk of cookie leakage. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for undici →
FAQ
Undici is an open-source HTTP/1.1 client implementation for Node.js.
The vulnerability can lead to the accidental leakage of cookies to unauthorized third-party sites or malicious attackers.
To fix the vulnerability, update the Undici package to version 5.26.2 or later.
No, there is no known workaround. Updating the package is the recommended solution.
For more information, you can refer to the GitHub Security Advisory GHSA-wqq4-5wpv-mx2g.
References
Related vulnerabilities
Recent vulnerabilities recorded for undici.
