Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline

Description

Undici cleared Authorization and Proxy-Authorization headers for fetch(), but did not clear them for undici.request().

Recommendation

Update the undici package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 6.0.0, < 6.11.1

  < 5.28.4**

• Patched version(s): **6.11.1

  5.28.4**

References

• GHSA-m4v8-wqvr-p9f7
• hackerone.com
• lists.fedoraproject.org
• CVE-2024-30260
• CWE-200
• CWE-285
• CWE-863
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes (GHSA-x8qp-wqqm-57ph) 4 - CVE-2025-53892
• vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes (GHSA-x8qp-wqqm-57ph) 2 - CVE-2025-53892
• undici Denial of Service attack via bad certificate data - CVE-2025-47279
• Use of Insufficiently Random Values in undici - CVE-2025-22150

Tags:

npm

undici