{"cve":"CVE-2022-32210","nvd":{"published":"2022-07-14T15:15:08.183","modified":"2026-06-17T04:46:52.510","status":"Modified","description":"`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","score":6.5},"cwes":["CWE-295"],"references":["https://github.com/nodejs/undici/security/advisories/GHSA-pgw7-wx7w-2w33","https://hackerone.com/reports/1583680","https://github.com/nodejs/undici/security/advisories/GHSA-pgw7-wx7w-2w33","https://hackerone.com/reports/1583680"],"products":["nodejs:undici"],"source":"nvd","synced_at":"2026-10-19T21:33:44.859608815+00:00"},"epss":{"cve":"CVE-2022-32210","score":0.00466,"percentile":0.4039,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-pgw7-wx7w-2w33","url":"https://osv.dev/vulnerability/GHSA-pgw7-wx7w-2w33","summary":"ProxyAgent vulnerable to MITM","modified":"2026-07-08T06:29:56.512359479Z","packages":[{"ecosystem":"npm","name":"undici","purl":"pkg:npm/undici","ranges":[">=4.8.2 <5.5.1"],"fixed":["5.5.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}