LiveActive security incident?Get immediate response
CVE Record

CVE-2022-31151: Uncleared cookies on cross-host/cross-origin redirect in undici

Authorization headers are cleared on cross-origin redirect. However, cookie headers which are sensitive headers and are official headers found in the spec, remain uncleared. There are active users using cookie headers in undici. This may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site. This was patched in v5.7.1. By default, this vulnerability is not exploitable. Do not enable redirections, i.e. `maxRedirections: 0` (the default).

LowCVSS 3.7Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

A Node.js HTTP client library, undici, could accidentally send application Cookie headers to another host during a cross-origin redirect. The default setting disables redirects, so default use is not exposed. Risk rises when applications enable redirects and send sensitive cookies through undici.

Executive priority

Treat as low urgency unless affected services enable redirects while sending sensitive cookies. Remediate through normal dependency update cycles and prioritize internet-facing services handling session or authentication cookies.

Technical view

In undici before 5.7.1, Authorization headers were cleared on cross-origin redirects, but Cookie headers were not. If redirects were enabled, a redirected request could carry cookies to a third-party or attacker-controlled target. The issue is patched in 5.7.1.

Likely exposure

Most exposure is in Node.js services using undici versions before 5.7.1 with redirects enabled and explicit Cookie headers. Default maxRedirections: 0 is stated as not exploitable.

Exploitation context

No active exploitation is supported by the provided sources; KEV is false. Practical abuse requires affected undici usage, redirects enabled, Cookie headers present, and a redirect path to a third-party or attacker-controlled destination.

Researcher notes

The core condition is header-clearing inconsistency during cross-origin redirects. Sources state the default is not exploitable. Evidence does not establish active exploitation, broad product impact, or mitigations beyond updating and disabling redirects.

Mitigation direction

  • Upgrade undici to version 5.7.1 or later.
  • Keep redirects disabled with maxRedirections: 0 where possible.
  • Audit code for undici redirects combined with Cookie headers.
  • Check vendor advisories for bundled or downstream undici usage.

Validation and detection

  • Inventory dependency trees for undici versions below 5.7.1.
  • Review runtime configuration for enabled redirects.
  • Inspect request-building code for explicit Cookie header use.
  • Confirm updated packages are deployed in production artifacts.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-601: User-session and phishing behavior lookup

Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2022-31151 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Low
CVSS
3.7 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
3.7CVSS 3.1LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N2.21.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

3.7Low
CVSS 3.1 vector shape for CVE-2022-31151Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
nodejsundici< 5.7.1Listed
Weakness

CWE details

CWE-601

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.