Threats tagged 'ghsa-m4v8-wqvr-p9f7'

Undici, a Node.js HTTP client, had a vulnerability where the Proxy-Authorization header was not cleared on cross-origin redirects for certain request methods like undici.request(), unlike fetch() which cleared these headers. This could lead to unintended credential exposure during redirects. The issue has been patched in versions 5.28.4 and 6.11.1. Users are advised to upgrade to these versions or use fetch() or disable maxRedirections as a workaround.