Skip to content
OpenAdvisories

Archive

12 October 2023

Vulnerabilities first published on this day (UTC), newest first.

1 result · Clear filters · Feed

  • Low 3.9

    Undici's cookie header not cleared on cross-origin redirect in fetch

    Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design, `cookie` headers are forbidden request headers, disa…