CVE catalog
CVE-2022-32210
node-undici: CVE-2022-32210
- Severity
- Medium
- Source
- [NVD] · [CVE record]
- EPSS
- 0.47% · Oct 25, 2026
`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | node-undici | sid | 8.12.2+dfsg+~cs3.2.3-2 | fixed |
| Debian | node-undici | forky | 8.10.2+dfsg+~cs3.2.2-1 | fixed |
| Debian | node-undici | trixie | 7.3.0+dfsg1+~cs24.12.11-1 | fixed |
| Debian | node-undici | bookworm | 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4 | fixed |
| Debian | node-undici | bookworm-security | 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | node-undici | source | sid | 5.6.1+dfsg1+~cs18.9.16-1 | not yet assigned | Not reported | Not reported |
| Debian | node-undici | source | forky | 5.6.1+dfsg1+~cs18.9.16-1 | not yet assigned | Not reported | Not reported |
| Debian | node-undici | source | trixie | 5.6.1+dfsg1+~cs18.9.16-1 | not yet assigned | Not reported | Not reported |
| Debian | node-undici | source | bookworm | 5.6.1+dfsg1+~cs18.9.16-1 | not yet assigned | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [node-llhttp]Fixed
Source package: [node-undici]
Details (4)
8.1.0~5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4· all · bookwormFixed · Fixed:
5.6.1+dfsg1+~cs18.9.16-1dsa · node-undici · debian · bookworm
8.1.0~5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4· all · bookwormFixed · Fixed:
5.6.1+dfsg1+~cs18.9.16-1dsa · node-undici · debian · bookworm
8.1.0~5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3· all · bookworm-securityFixed · Fixed:
5.6.1+dfsg1+~cs18.9.16-1dsa · node-undici · debian · bookworm
8.1.0~5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3· all · bookworm-securityFixed · Fixed:
5.6.1+dfsg1+~cs18.9.16-1dsa · node-undici · debian · bookworm
- [node-undici]Fixed
Details (4)
5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4· all · bookwormFixed · Fixed:
5.6.1+dfsg1+~cs18.9.16-1dsa · node-undici · debian · bookworm
5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4· all · bookwormFixed · Fixed:
5.6.1+dfsg1+~cs18.9.16-1dsa · node-undici · debian · bookworm
5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3· all · bookworm-securityFixed · Fixed:
5.6.1+dfsg1+~cs18.9.16-1dsa · node-undici · debian · bookworm
5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3· all · bookworm-securityFixed · Fixed:
5.6.1+dfsg1+~cs18.9.16-1dsa · node-undici · debian · bookworm
Observed: