CVE-2022-32210

Published: Jul 14, 2022Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Exploitability: 2.2 / Impact: 4.2

Source: NVD

Description

`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.

Affected (1)

Products: Nodejs: Undici

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Nodejs Undici	From 4.8.2 to 5.5.1

Related CWEs

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References (4)

https://github.com/nodejs/undici/security/advisories/GHSA-pgw7-wx7w-2w33

Source: support@hackerone.com

ExploitThird Party Advisory

https://hackerone.com/reports/1583680

Source: support@hackerone.com

ExploitIssue TrackingThird Party Advisory

https://github.com/nodejs/undici/security/advisories/GHSA-pgw7-wx7w-2w33

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://hackerone.com/reports/1583680

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingThird Party Advisory

Timeline

No history available yet.