Undici proxy-authorization header not cleared on cross-origin redirect in fetch

Description

Undici already cleared Authorization headers on cross-origin redirects, but did not clear Proxy-Authorization headers.

Recommendation

Update the undici package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 6.0.0, <= 6.6.0

  <= 5.28.2**

• Patched version(s): **6.6.1

  5.28.3**

References

• GHSA-3787-6prv-h9w3
• security.netapp.com
• www.openwall.com
• CVE-2024-24758
• CWE-200
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Mermaid does not properly sanitize architecture diagram iconText leading to XSS - CVE-2025-54880
• PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF - CVE-2024-4367
• create-choo-app3 is vulnerable to Command Injection via the devInstall function - CVE-2022-25855
• Vue I18n Allows Prototype Pollution in `handleFlatJson` (GHSA-p2ph-7g93-hw3m) 5 - CVE-2025-27597

Tags:

npm

undici