CVE-2022-32210

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-32210
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-32210.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-32210
Aliases
Downstream
Published
2022-07-14T14:51:40Z
Modified
2026-07-15T01:48:57.689643594Z
Summary
[none]
Details

Undici.ProxyAgent never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.

Database specific 
{
    "cna_assigner": "hackerone",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/32xxx/CVE-2022-32210.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "Fixed in version >= v5.5.1. Vulnerable between v4.8.2 and v5.5.0"
                },
                {
                    "last_affected": "Fixed in version >= v5.5.1. Vulnerable between v4.8.2 and v5.5.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-295"
    ]
}
References

Affected packages

Git / github.com/nodejs/undici

Affected ranges

Type
GIT
Repo
https://github.com/nodejs/undici
Events
Introduced
7b03c91cefbb46cd9172db4b2758b34155b4f764
Fixed
19563f76ad38a8b4b2b1bfc78957c384775686e3
Database specific 
{
    "cpe": "cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*",
    "extracted_events": [
        {
            "introduced": "4.8.2"
        },
        {
            "fixed": "5.5.1"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v4.*
v4.10.0
v4.10.1
v4.10.2
v4.10.3
v4.10.4
v4.11.0
v4.11.1
v4.11.2
v4.11.3
v4.12.0
v4.12.2
v4.13.0
v4.14.0
v4.14.1
v4.15.0
v4.15.1
v4.16.0
v4.8.2
v4.9.0
v4.9.1
v4.9.2
v4.9.3
v4.9.4
v4.9.5
v5.*
v5.0.0
v5.1.0
v5.1.1
v5.2.0
v5.3.0
v5.4.0
v5.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-32210.json"