CVE-2023-45143

npm/undici CVE-2023-45143: low 3.9

Undici's cookie header not cleared on cross-origin redirect in fetch

Action: Upgrade undici to 5.26.2 or later.

npm i undici@5.26.2

Affected

Fixed versions

Sources

• osv: GHSA-wqq4-5wpv-mx2g
• https://github.com/nodejs/undici/security/advisories/GHSA-q768-x9m6-m9qp
• https://github.com/nodejs/undici/security/advisories/GHSA-wqq4-5wpv-mx2g
• https://nvd.nist.gov/vuln/detail/CVE-2023-45143
• https://github.com/nodejs/undici/commit/e041de359221ebeae04c469e8aff4145764e6d76
• https://hackerone.com/reports/2166948
• https://github.com/nodejs/undici
• https://github.com/nodejs/undici/releases/tag/v5.26.2
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y

CVE-2023-45143 · published 2023-10-16T14:05:37Z · modified 2026-02-04T02:35:56.289390Z · JSON