CVE-2023-45143

Overview

Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. It uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, and it is widely used for web applications and server-side development. Node.js bundles undici, an HTTP/1.1 client, as the implementation behind its built-in global fetch() API (experimental starting in Node.js 16.15.0, stable and enabled by default since Node.js 18).

An information exposure vulnerability (CVE-2023-45143) was identified in undici: when a request received a cross-origin HTTP redirect, undici correctly stripped the Authorization header from the redirected request but failed to also strip the Cookie header. This allowed a cookie set for one origin to be forwarded to a different, redirect-target origin, which could leak session credentials to a third-party site or to an attacker who controls the redirect target.

This issue affects any Node.js build with the bundled undici client (and therefore the global fetch API) below version 5.26.2, namely Node.js 16.15.0 and later, all of 18.x prior to 18.18.2, and 19.x/20.x prior to 20.8.1. Node.js 12.x and 14.x are not affected because neither line ever bundled undici or the fetch API.

Details

Module Info

• Product: Node.js
• Affected packages: undici (Node.js's bundled HTTP/1.1 client and the implementation behind the global fetch() API, vendored at deps/undici); also published standalone as undici on npm, which is independently affected below 5.26.2
• Affected versions: bundled undici <5.26.2; affects Node.js 16.15.0 and later through <16.20.3 (NES), 18.x <18.18.2, and 19.x/20.x <20.8.1; Node.js 12.x and 14.x are not affected (fetch/undici was not part of those release lines)
• GitHub repository: https://github.com/nodejs/node (bundled copy); https://github.com/nodejs/undici (upstream project)
• Published packages: https://nodejs.org/en/download (Node.js itself); https://www.npmjs.com/package/undici (the standalone package)
• Package manager: Not applicable for Node.js itself. Node.js is distributed as runtime builds from nodejs.org rather than as a published npm package; the standalone undici package is npm-distributed.
• Fixed in: Node.js 18.18.2 and 20.8.1 (upstream, October 13, 2023); Node.js NES 16.20.3 (July 30, 2024), as a post-EOL security fix.

Vulnerability Info

This Low-severity vulnerability is found in undici, the HTTP client Node.js bundles internally and uses to implement the global fetch() API. Per the Fetch and WHATWG redirect specifications that browsers implement, credential-bearing headers such as Authorization are expected to be dropped when a redirect changes the request's origin, so that credentials scoped to the original site are not silently handed to a different site.

Undici implemented the Authorization-header removal correctly but did not extend the same handling to the Cookie header. A request that carried an explicit Cookie header (set directly by application code, since undici does not implement an automatic browser-style cookie jar) would have that Cookie header forwarded unchanged across a cross-origin redirect, exposing it to whatever origin the redirect pointed at, including an origin controlled by an attacker who can influence the redirect target. See GHSA-wqq4-5wpv-mx2g for the upstream advisory.

Note: Node.js's global fetch() implementation is built directly on undici and inherits this behavior; the standalone undici npm package used directly by an application has the identical bug below 5.26.2, independent of which Node.js version it runs on.

Mitigation

Node.js 16.x reached End-of-Life on September 11, 2023; Node.js 18.x reached End-of-Life on April 30, 2025; and Node.js 20.x reached End-of-Life on April 30, 2026. None of these lines will receive further upstream updates. For more information see Node.js's release schedule.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported Node.js LTS release (22.x or 24.x), both of which include the fix; if using the standalone undici package directly, upgrade it to 5.26.2 or later independent of the Node.js version.
• Migrate affected applications away from the End-of-Life Node.js release line(s).
• Leverage a commercial support partner like HeroDevs for post-EOL security support, through Node.js NES.

Credits

• ranjit-git (reporter)
• KhafraDev from the undici project (remediation developer)
• mcollina from the undici project (coordinator)