undici vulnerable to cross-origin credential disclosure via array-of-tuples headers bypassing redirect stripping

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, the redirect interceptor strips sensitive headers such as Authorization, Cookie, Proxy-Authorization, and Host when a request is redirected to a different origin, but when request headers are supplied as an array of name and value tuples (a valid documented input, for example from Object.entries), the redirect handler misreads them as a flat list so the header names never match and the sensitive headers are not removed. If a header-normalizing interceptor such as cache or deduplicate is composed outside the redirect interceptor, it then serializes the retained headers onto the cross-origin request, disclosing the caller's origin-bound credentials to the unrelated redirect destination. This is a representation-dependent bypass of the cross-origin header stripping added in CVE-2024-30260. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, supply request headers as a plain object or a flat name and value array rather than an array of tuples, or compose the redirect interceptor outside the normalizing interceptor.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…undici/security/advisories/GHSA-9v6h-8rgp-m69f Diğer
• cna.openjsf.org/security-advisories.html Diğer

Kayıt geçmişi

1. 6 Kas 2026 13:10Yayımlandı

İlgili açıklar

• 5,9 CVE-2026-116630undici vulnerable to cross-user information disclosure via cross-origin redirect revalidation
• 5,9 CVE-2026-120423undici vulnerable to Subresource Integrity bypass via whitespace in integrity metadata
• 7,4 CVE-2026-116592undici HTTP istemcisinde yönlendirme zincirinde önbellek zehirlenmesi ve kullanıcılar arası veri sızıntısı
• 5,9 CVE-2026-120222undici vulnerable to Denial of Service via unhandled exception in cache-interceptor response replay
• 6,5 CVE-2026-120474undici vulnerable to cross-user cache disclosure via same-origin redirect
• 4,2 CVE-2026-35112HCL AION is affected by multiple security vulnerabilities.