Description
Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nodejs | undici | < 5.28.3, >= 6.0.0, < 6.6.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-undici | 5.28.4+dfsg1+~cs23.12.11-1 | — |
| Debian 13 | node-undici | 5.28.4+dfsg1+~cs23.12.11-1 | — |
| Debian 12 | node-undici | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-undici | No fix yet | — |
| Ubuntu 26.04 LTS | node-undici | No fix yet | — |
| Ubuntu 25.10 | node-undici | No fix yet | — |
| Ubuntu 24.04 LTS | node-undici | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | nodejs18 | 18.19.1-150400.9.18.2 | SUSE-SU-2024:0730-1 |
| SLES 15 SP5 | nodejs20 | 20.11.1-150500.11.6.1 | SUSE-SU-2024:0643-1 |
| SLES 15 SP4 | nodejs16 | 16.20.2-150400.3.30.1 | SUSE-SU-2024:0728-1 |
| SLES 15 SP4 | nodejs18 | 18.19.1-150400.9.18.2 | SUSE-SU-2024:0730-1 |
| SLES 15 SP3 | nodejs16 | 16.20.2-150300.7.33.1 | SUSE-SU-2024:0729-1 |
| SLES 12 | nodejs16 | 16.20.2-8.39.1 | SUSE-SU-2024:0731-1 |
| SLES 12 | nodejs18 | 18.19.1-8.18.1 | SUSE-SU-2024:0644-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP4 | nodejs16 | 16.20.2-150400.3.30.1 | SUSE-SU-2024:0728-1 |
| SLES for SAP 15 SP4 | nodejs18 | 18.19.1-150400.9.18.2 | SUSE-SU-2024:0730-1 |
| SLES for SAP 15 SP3 | nodejs16 | 16.20.2-150300.7.33.1 | SUSE-SU-2024:0729-1 |
| SLE HPC 15 SP4 | nodejs16 | 16.20.2-150400.3.30.1 | SUSE-SU-2024:0728-1 |
| SLE HPC 15 SP4 | nodejs18 | 18.19.1-150400.9.18.2 | SUSE-SU-2024:0730-1 |
| SLE HPC 15 SP3 | nodejs16 | 16.20.2-150300.7.33.1 | SUSE-SU-2024:0729-1 |
| SUSE Manager Server 4.3 | nodejs16 | 16.20.2-150400.3.30.1 | SUSE-SU-2024:0728-1 |
| SUSE Manager Server 4.3 | nodejs18 | 18.19.1-150400.9.18.2 | SUSE-SU-2024:0730-1 |
| SUSE Enterprise Storage 7.1 | nodejs16 | 16.20.2-150300.7.33.1 | SUSE-SU-2024:0729-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | nodejs20 | 20.11.1-1.1 | openSUSE-SU-2024:13697-1 |
| openSUSE Tumbleweed | nodejs21 | 21.6.2-1.1 | openSUSE-SU-2024:13698-1 |
| openSUSE Leap 15.5 | nodejs18 | 18.19.1-150400.9.18.2 | SUSE-SU-2024:0730-1 |
| openSUSE Leap 15.5 | nodejs20 | 20.11.1-150500.11.6.1 | SUSE-SU-2024:0643-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | nodejs +4 | 1:18.18.2-1.amzn2023.0.3 | ALAS2023-2024-568 |
| Amazon Linux 2023 | nodejs-npm | 1:9.8.1-1.18.18.2.1.amzn2023.0.3 | ALAS2023-2024-568 |
| Amazon Linux 2023 | nodejs20 +4 | 1:20.11.1-1.amzn2023.0.1 | ALAS2023-2024-544 |
| Amazon Linux 2023 | nodejs20-npm | 1:10.2.4-1.20.11.1.1.amzn2023.0.1 | ALAS2023-2024-544 |
| Amazon Linux 2023 | v8-10.2-devel | 3:10.2.154.26-1.18.18.2.1.amzn2023.0.3 | ALAS2023-2024-568 |
| Amazon Linux 2023 | v8-11.3-devel | 3:11.3.244.8-1.20.11.1.1.amzn2023.0.1 | ALAS2023-2024-544 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | nodejs | 20.14.0-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | undici | < 5.28.3 | 5.28.3 | GHSA-3787-6prv-h9w3 |
| npm | undici | >= 6.0.0, < 6.6.1 | 6.6.1 | GHSA-3787-6prv-h9w3 |
Advisories 14
- WID-SEC-2024-0393 Node.js: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 28, 2026
- SUSE-SU-2024:0730-1 Security update for nodejs18 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0643-1 Security update for nodejs20 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0728-1 Security update for nodejs16 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13698-1 corepack21-21.6.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0729-1 Security update for nodejs16 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0644-1 Security update for nodejs18 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13697-1 corepack20-20.11.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0731-1 Security update for nodejs16 SUSE / openSUSE Security Updates · Feb 4, 2026
- NCSC-2024-0433 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Nov 12, 2024
- ICSA-24-319-08 Siemens SINEC INS CISA ICS & IT advisories · Nov 12, 2024
- SSA-915275 SSA-915275: Multiple Vulnerabilities in SINEC INS Before V1.0 SP2 Update 3 Siemens ProductCERT · Nov 12, 2024
- ALAS2023-2024-568 Moderate: nodejs security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 21, 2024
- ALAS2023-2024-544 Important: nodejs20 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 13, 2024