https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 17:32:40 +0000 https://cve.radiocsirt.org/vuln/bdu:2022-04275 bdu:2022-04275 https://cve.radiocsirt.org/vuln/bdu:2022-04275 https://cve.radiocsirt.org/vuln/euvd-2026-17229 EUVD-2026-17229 https://cve.radiocsirt.org/vuln/euvd-2026-17229 https://cve.radiocsirt.org/vuln/fkie_cve-2022-32210 <p>`Undici.ProxyAgent` never verifies the remote server&#39;s certificate, and always exposes all request &amp; response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy&#39;s URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.</p> <p>`Undici.ProxyAgent` never verifies the remote server&#39;s certificate, and always exposes all request &amp; response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy&#39;s URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-32210 https://cve.radiocsirt.org/vuln/ghsa-pgw7-wx7w-2w33 <p><strong>Affected:</strong> npm: undici</p> <p>### Description</p> <p>`Undici.ProxyAgent` never verifies the remote server&#39;s certificate, and always exposes all request &amp; response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy&#39;s URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.</p> <p>### Impact</p> <p>This affects all use of HTTPS via HTTP proxy using **`Undici.ProxyAgent`** with Undici or Node&#39;s global `fetch`. In this case, it removes all HTTPS security from all requests sent using Undici&#39;s `ProxyAgent`, allowing trivial MitM attacks by anybody on the network path between the client and the target server (local network users, your ISP, the proxy, the target server&#39;s ISP, etc). This less seriously affects HTTPS via HTTPS proxies. When you send HTTPS via a proxy to a remote server, the proxy can freely view or modify all HTTPS traffic unexpectedly (but only the proxy).</p> <p>### Patches</p> <p>This issue was patched in Undici v5.5.1.</p> <p>### Workarounds</p> <p>At the time of writing, the only workaround is to not use `ProxyAgent` as a dispatcher for TLS Connections.</p> <p><strong>Affected:</strong> npm: undici</p> <p>### Description</p> <p>`Undici.ProxyAgent` never verifies the remote server&#39;s certificate, and always exposes all request &amp; response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy&#39;s URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.</p> <p>### Impact</p> <p>This affects all use of HTTPS via HTTP proxy using **`Undici.ProxyAgent`** with Undici or Node&#39;s global `fetch`. In this case, it removes all HTTPS security from all requests sent using Undici&#39;s `ProxyAgent`, allowing trivial MitM attacks by anybody on the network path between the client and the target server (local network users, your ISP, the proxy, the target server&#39;s ISP, etc). This less seriously affects HTTPS via HTTPS proxies. When you send HTTPS via a proxy to a remote server, the proxy can freely view or modify all HTTPS traffic unexpectedly (but only the proxy).</p> <p>### Patches</p> <p>This issue was patched in Undici v5.5.1.</p> <p>### Workarounds</p> <p>At the time of writing, the only workaround is to not use `ProxyAgent` as a dispatcher for TLS Connections.</p> https://cve.radiocsirt.org/vuln/ghsa-pgw7-wx7w-2w33 https://cve.radiocsirt.org/vuln/gsd-2022-32210 gsd-2022-32210 https://cve.radiocsirt.org/vuln/gsd-2022-32210