{"id":"CVE-2022-31151","aliases":["GHSA-q768-x9m6-m9qp"],"url":"https://o3.security/vulnerability/CVE-2022-31151","summary":"Uncleared cookies on cross-host/cross-origin redirect in undici","details":"### Impact\n\nAuthorization headers are already cleared on cross-origin redirect in\nhttps://github.com/nodejs/undici/blob/main/lib/handler/redirect.js#L189, based on https://github.com/nodejs/undici/issues/872.\n\nHowever, cookie headers which are sensitive headers and are official headers found in the spec, remain uncleared. There also has been active discussion of implementing a cookie store https://github.com/nodejs/undici/pull/1441, which suggests that there are active users using cookie headers in undici.\nAs such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site.\n\n### Patches\n\nThis was patched in v5.8.0.\n\n### Workarounds\n\nBy default, this vulnerability is not exploitable.\nDo not enable redirections, i.e. `maxRedirections: 0` (the default). \n\n### References\n\nhttps://hackerone.com/reports/1635514\nhttps://curl.se/docs/CVE-2018-1000007.html\nhttps://curl.se/docs/CVE-2022-27776.html\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [undici repository](https://github.com/nodejs/undici/issues)\n* To make a report, follow the [SECURITY](https://github.com/nodejs/node/blob/HEAD/SECURITY.md) document\n","published":"2022-07-20T23:00:15Z","modified":"2026-03-14T11:46:19.454963Z","cvss":{"score":3.7,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"npm","name":"undici","fixedVersion":"5.8.0"}],"fix":{"url":"https://github.com/nodejs/undici/pull/1441","label":"nodejs/undici#1441"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31151.json"},{"type":"REPORT","url":"https://github.com/nodejs/undici/issues/872"},{"type":"ADVISORY","url":"https://github.com/nodejs/undici/security/advisories/GHSA-q768-x9m6-m9qp"},{"type":"WEB","url":"https://hackerone.com/reports/1635514"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31151"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20220909-0006/"},{"type":"WEB","url":"https://github.com/nodejs/undici/pull/1441"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/0a5bee9465e627be36bac88edf7d9bbc9626126d"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/blob/main/lib/handler/redirect.js#L189"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v5.8.0"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20220909-0006"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-03-14T11:46:19.454963Z"}}