{"action":"Upgrade undici to 5.26.2 or later.","affected":[{"fixed":"5.26.2","introduced":"0"}],"component":"undici","cve_ids":["CVE-2023-45143"],"ecosystem":"npm","epss":0.01368,"exploited":false,"fixed_versions":["5.26.2"],"ghsa_id":"GHSA-wqq4-5wpv-mx2g","id":"tcs_01M5KGFS6G9QY545EMWK87F4BA","modified_at":"2026-02-04T02:35:56.289390Z","published_at":"2023-10-16T14:05:37Z","references":["https://osv.dev/vulnerability/GHSA-wqq4-5wpv-mx2g","https://github.com/nodejs/undici/security/advisories/GHSA-q768-x9m6-m9qp","https://github.com/nodejs/undici/security/advisories/GHSA-wqq4-5wpv-mx2g","https://nvd.nist.gov/vuln/detail/CVE-2023-45143","https://github.com/nodejs/undici/commit/e041de359221ebeae04c469e8aff4145764e6d76","https://hackerone.com/reports/2166948","https://github.com/nodejs/undici","https://github.com/nodejs/undici/releases/tag/v5.26.2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y"],"severity":{"label":"low","score":3.9},"sources":[{"source":"osv","source_id":"GHSA-wqq4-5wpv-mx2g","url":"https://osv.dev/vulnerability/GHSA-wqq4-5wpv-mx2g"}],"summary":"Undici's cookie header not cleared on cross-origin redirect in fetch"}