CVE-2023-45143: Node.js Undici Information Disclosure Flaw

CVE-2023-45143 Overview

CVE-2023-45143 is an information disclosure vulnerability in Undici, the HTTP/1.1 client written from scratch for Node.js. Versions prior to 5.26.2 cleared Authorization headers on cross-origin redirects but failed to strip Cookie headers. Browsers treat Cookie as a forbidden request header, but Undici handled headers more liberally than the Fetch specification assumed. Attackers controlling a redirect target, such as an open redirector, can capture session cookies sent to a third-party origin. The issue is tracked as [CWE-200] Information Exposure and was patched in Undici 5.26.2.

Critical Impact
Session cookies set on RequestInit.headers can leak to attacker-controlled origins through cross-origin redirects, enabling session hijacking against Node.js applications that proxy authenticated requests.

Affected Products

Node.js Undici prior to version 5.26.2
Fedora 37, 38, and 39 (distributed Undici packages)
Applications using Undici's fetch implementation for upstream HTTP calls

Discovery Timeline

2023-10-12 - CVE-2023-45143 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-45143

Vulnerability Analysis

Undici implements the WHATWG Fetch specification for Node.js. The Fetch spec relies on browsers blocking forbidden request headers such as Cookie and Host at the RequestInit boundary. Node.js has no such enforcement, so callers can pass arbitrary headers, including authentication cookies, directly into fetch().

When Undici followed a redirect to a different origin, it correctly invoked the CORS non-wildcard handling and removed the Authorization header. The redirect logic did not delete Cookie or Host, so those headers traveled to the new origin unchanged. An attacker who controls the redirect destination receives the user's session cookie verbatim.

The vulnerability requires a developer to attach a Cookie header to a fetch request and a redirect path that ends at an attacker-controlled host. Open redirectors on trusted domains and server-side request forwarding patterns make this reachable in real applications.

Root Cause

The redirect handler in lib/fetch/index.js enforced only the spec's authorization rule. It did not mirror the browser behavior of stripping forbidden request headers that carry origin-bound credentials. The disconnect between the spec's assumptions and Undici's permissive header model produced the leak.

Attack Vector

Exploitation requires a Node.js application that uses Undici fetch with caller-supplied Cookie headers and a cross-origin redirect. The attacker either hosts the final destination or abuses an open redirector inside the trusted origin. User interaction is needed only when the request is triggered by user-driven flows.

javascript

   if (!sameOrigin(requestCurrentURL(request), locationURL)) {
     // https://fetch.spec.whatwg.org/#cors-non-wildcard-request-header-name
     request.headersList.delete('authorization')
+
+    // "Cookie" and "Host" are forbidden request-headers, which undici doesn't implement.
+    request.headersList.delete('cookie')
+    request.headersList.delete('host')
   }
 
   // 14. If request's body is non-null, then set request's body to the first return

Source: Undici commit e041de3. The patch extends the cross-origin branch to delete cookie and host headers alongside authorization.

Detection Methods for CVE-2023-45143

Indicators of Compromise

Outbound HTTPS requests from Node.js services to unexpected third-party hosts carrying Cookie headers belonging to internal sessions.
Web server logs showing 30x redirects from trusted endpoints to attacker-controlled domains followed by authenticated requests.
Session reuse from IP addresses or user agents that do not match the legitimate client population.

Detection Strategies

Inventory installed Undici versions across application dependencies using npm ls undici and flag any release earlier than 5.26.2.
Inspect HTTP egress at proxies or service meshes for cross-origin redirect chains that preserve Cookie headers.
Audit application source for fetch() calls that attach Cookie headers and follow redirects without setting redirect: 'manual'.

Monitoring Recommendations

Alert on session cookie values appearing in egress traffic to domains outside the application's allowlist.
Monitor authentication services for concurrent session usage from distinct origins after redirect events.
Track changes to package-lock.json and yarn.lock to confirm Undici stays at a patched version after upgrades.

How to Mitigate CVE-2023-45143

Immediate Actions Required

Upgrade Undici to 5.26.2 or later in every Node.js service, including transitive dependencies pulled in by frameworks such as Next.js and @octokit/request.
Rebuild and redeploy container images so the patched library replaces cached node_modules artifacts.
Rotate any session cookies or credentials that may have been exposed by previously vulnerable redirect flows.

Patch Information

The fix is committed in Undici commit e041de3 and shipped in Undici release v5.26.2. Advisory details are documented in GHSA-wqq4-5wpv-mx2g and HackerOne Report #2166948. Fedora users should apply the updates announced in the Fedora package advisories.

Workarounds

No vendor workarounds exist; the security advisory states there are no known mitigations short of upgrading.
As a defensive coding practice, set redirect: 'manual' on fetch() calls that include Cookie headers and handle redirects explicitly after validating the target origin.
Strip Cookie headers from outbound requests in a wrapper around Undici when the destination is not a trusted same-origin endpoint.

bash

# Upgrade Undici to the patched release
npm install undici@5.26.2

# Verify the resolved version across the dependency tree
npm ls undici

# Fedora: apply the distribution update
sudo dnf update nodejs-undici