Most recent entries from all

EUVD-2026-232654

fkie_cve-2022-35949

undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`. If a user specifies a URL such as `http://127.0.0.1` or `//127.0.0.1` ```js const undici = require("undici") undici.request({origin: "http://example.com", pathname: "//127.0.0.1"}) ``` Instead of processing the request as `http://example.org//127.0.0.1` (or `http://example.org/http://127.0.0.1` when `http://127.0.0.1 is used`), it actually processes the request as `http://127.0.0.1/` and sends it to `http://127.0.0.1`. If a developer passes in user input into `path` parameter of `undici.request`, it can result in an _SSRF_ as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL. This issue was fixed in `undici@5.8.1`. The best workaround is to validate user input before passing it to the `undici.request` call.

GHSA-8qr4-xgw6-wmr3 — `undici.request` vulnerable to SSRF using absolute URL on `pathname`

Affected: npm: undici

### Impact

`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`.

If a user specifies a URL such as `http://127.0.0.1` or `//127.0.0.1`

```js const undici = require("undici") undici.request({origin: "http://example.com", pathname: "//127.0.0.1"}) ```

Instead of processing the request as `http://example.org//127.0.0.1` (or `http://example.org/http://127.0.0.1` when `http://127.0.0.1 is used`), it actually processes the request as `http://127.0.0.1/` and sends it to `http://127.0.0.1`.

If a developer passes in user input into `path` parameter of `undici.request`, it can result in an _SSRF_ as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL.

### Patches

This issue was fixed in `undici@5.8.1`.

### Workarounds

The best workaround is to validate user input before passing it to the `undici.request` call.

## For more information If you have any questions or comments about this advisory:

- Open an issue in [undici repository](https://github.com/nodejs/undici/issues) - To make a report, follow the [SECURITY](https://github.com/nodejs/node/blob/HEAD/SECURITY.md) document

gsd-2022-35949

openSUSE-SU-2024:12285-1 — corepack16-16.17.0-2.1 on GA media

corepack16-16.17.0-2.1 on GA media

RHSA-2022:7276 — Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.4.8 security fixes and container updates

search-api: SQL injection leads to remote denial of service terser: insecure use of regular expressions leads to ReDoS moment: inefficient parsing algorithm resulting in DoS nodejs: undici vulnerable to CRLF via content headers nodejs: undici.request vulnerable to SSRF

SUSE-SU-2022:3196-1 — Security update for nodejs16

Security update for nodejs16

WID-SEC-W-2022-1933 — Red Hat Satellite und Red Hat Enterprise Linux: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Satellite und Red Hat Enterprise Linux ausnutzen, um einen Denial of Service oder nicht spezifizierten Angriff durchzuführen.