{"cve":"CVE-2022-31151","nvd":{"published":"2022-07-21T04:15:12.157","modified":"2026-06-17T04:44:54.663","status":"Modified","description":"Authorization headers are cleared on cross-origin redirect. However, cookie headers which are sensitive headers and are official headers found in the spec, remain uncleared. There are active users using cookie headers in undici. This may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site. This was patched in v5.7.1. By default, this vulnerability is not exploitable. Do not enable redirections, i.e. `maxRedirections: 0` (the default).","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":6.5},"cwes":["CWE-346","CWE-601"],"references":["https://github.com/nodejs/undici/issues/872","https://github.com/nodejs/undici/security/advisories/GHSA-q768-x9m6-m9qp","https://hackerone.com/reports/1635514","https://security.netapp.com/advisory/ntap-20220909-0006/","https://github.com/nodejs/undici/issues/872"],"products":["nodejs:undici"],"source":"nvd","synced_at":"2026-10-19T21:33:44.859608815+00:00"},"epss":{"cve":"CVE-2022-31151","score":0.00739,"percentile":0.54573,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-q768-x9m6-m9qp","url":"https://osv.dev/vulnerability/GHSA-q768-x9m6-m9qp","summary":"undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect","modified":"2026-02-04T03:02:08.652391Z","packages":[{"ecosystem":"npm","name":"undici","purl":"pkg:npm/undici","ranges":["<5.8.0"],"fixed":["5.8.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}