| Package | Affected versions | Patched versions |
|---|---|---|
| undici | ≥ 6.0.0, < 6.11.1< 5.28.4 | 6.11.15.28.4 |
| undici | ≥ 6.0.0, < 6.11.1< 5.28.4 | 6.11.15.28.4 |
Undici cleared Authorization and Proxy-Authorization headers for fetch(), but did not clear them for undici.request().
This has been patched in https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75. Fixes has been released in v5.28.4 and v6.11.1.
use fetch() or disable maxRedirections.
Linzi Shang reported this.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free