CVE-2022-31151

What it actually does

In vulnerable versions of the Node.js undici HTTP client, sensitive Cookie headers are not stripped when following a cross-origin redirect, even though Authorization headers are cleared. If an application explicitly enables redirect following, an HTTP request that includes cookies can be redirected to a different origin and the original Cookie header may be sent to that third-party destination. This can expose session cookies or application-specific secrets carried in cookies and may allow account/session misuse depending on cookie contents and downstream validation.

Why it matters to the business

Applications using undici may unintentionally disclose cookies to external or attacker-controlled services if they follow redirects. The operational risk is highest for services that send authentication or session cookies in outbound HTTP requests and allow redirects to untrusted domains. Although this is not exploitable with undici's default redirect behavior, exploit code is publicly available and undici is commonly embedded in Node.js applications and dependencies, so organizations should treat affected usage patterns as meaningful data-exposure risk.

How an attack unfolds

An attacker needs a way to influence the URL requested by an application using undici, or to control a server that the application legitimately contacts. The application must send a Cookie header and must have enabled redirect following using a non-default maxRedirections value. The attacker returns an HTTP 3xx redirect with a Location header pointing to an attacker-controlled or third-party origin. The vulnerable undici client follows the cross-origin redirect and incorrectly retains the Cookie header, causing the sensitive cookie value to be transmitted to the redirected destination. The attacker then captures the cookie from server logs, request inspection, or network telemetry on the destination service and may use it to impersonate the original session or gain access to protected resources if the cookie is accepted elsewhere.

How to fix it

Upgrade undici to version 5.7.1 or later. If immediate upgrade is not possible, disable automatic redirects by setting maxRedirections: 0, which is also the default behavior, and manually handle redirects only after validating that the destination origin is trusted. Avoid sending Cookie headers in server-side outbound requests unless strictly necessary. Where cookies are required, scope them narrowly, avoid reusing browser-session cookies in backend service calls, and prevent redirects to untrusted origins. Review direct and transitive Node.js dependencies that may bundle or invoke undici.

How to confirm the fix worked

Confirm the installed undici version is 5.7.1 or later using package manager metadata, lockfiles, container image contents, and runtime dependency inventory. Search application code and configuration for undici usage with redirect following enabled, especially maxRedirections values greater than 0. Test representative affected flows by sending a request with a benign Cookie header to a controlled endpoint that returns a cross-origin redirect, then verify that the redirected request does not include the Cookie header. Validate that dependency lockfiles and deployed artifacts match the remediated version, not only source manifests.

Typical attack path

1. Identify a Node.js application or dependency path that uses undici for outbound HTTP requests.
2. Find a request flow where the application includes a Cookie header in the undici request.
3. Confirm that redirect following is enabled, such as maxRedirections being set above 0.
4. Influence the original URL or control the upstream server response.
5. Return an HTTP 301, 302, 303, 307, or 308 redirect to an attacker-controlled origin.
6. Receive the redirected request and capture the leaked Cookie header.
7. Use the exposed cookie value for session hijacking, account access, or further application-specific abuse if the cookie is valid and reusable.

How to detect it

Investigate whether applications using undici sent Cookie headers during cross-origin redirects. Useful sources include application HTTP client debug logs, reverse proxy logs, egress proxy logs, web gateway logs, DNS logs, packet captures, and logs from any controlled upstream services that issue redirects. Look for outbound requests where an initial request to one host receives an HTTP 3xx response with a Location header pointing to a different scheme, host, or port, followed immediately by a second outbound request to that new origin that includes a Cookie header. Pay special attention to destinations that are newly observed, uncommon for the application, user-controlled, or associated with open redirect behavior. If an untrusted recipient received cookies, treat the cookie values as compromised and rotate or invalidate them. There are no known CVE-specific malware artifacts, filenames, process names, or registry keys associated with this issue; detection is primarily behavioral and log-correlation based.

What your security team should do

• Prioritize identifying applications that use Node.js undici and explicitly enable redirects with maxRedirections greater than 0.
• Upgrade undici to 5.7.1 or later across direct and transitive dependency paths.
• Add automated dependency scanning for vulnerable undici versions in source repositories, CI pipelines, containers, and deployed artifacts.
• Review outbound request code paths that attach Cookie headers and remove unnecessary cookie forwarding.
• Restrict automatic redirect handling to trusted origins or disable it entirely where not required.
• Inspect historical logs for cross-origin redirected requests that included Cookie headers, especially to unfamiliar external domains.
• Rotate any cookies, tokens, or session material confirmed to have been sent to untrusted destinations.
• Add regression tests to ensure sensitive headers are stripped on cross-origin redirects.