{
  "cveId": "CVE-2022-32210",
  "url": "https://patchblox.com/security/cve/CVE-2022-32210",
  "summary": "CVE-2022-32210 is fixed in node-undici on 1 platform, first by DEBIAN-CVE-2022-32210, released July 14, 2022. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "node-undici: \u0060Undici.ProxyAgent\u0060 never verifies the remote server\u0027s certificate, and always exposes all request \u0026 response data to...",
  "description": "\u0060Undici.ProxyAgent\u0060 never verifies the remote server\u0027s certificate, and always exposes all request \u0026 response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy\u0027s URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.",
  "published": "2022-07-14T15:15:08Z",
  "severity": "medium",
  "cvss": 6.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
  "epss": 0.00466,
  "epssPercentile": 0.40604,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "node-undici",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.6.1\u002Bdfsg1\u002B~cs18.9.16-1",
      "fix": "DEBIAN-CVE-2022-32210",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-32210",
      "released": "2022-07-14T15:15:08Z"
    },
    {
      "platform": "linux",
      "product": "node-undici",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.6.1\u002Bdfsg1\u002B~cs18.9.16-1",
      "fix": "DEBIAN-CVE-2022-32210",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-32210",
      "released": "2022-07-14T15:15:08Z"
    },
    {
      "platform": "linux",
      "product": "node-undici",
      "release": "Debian 14",
      "fixedVersion": "5.6.1\u002Bdfsg1\u002B~cs18.9.16-1",
      "fix": "DEBIAN-CVE-2022-32210",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-32210",
      "released": "2022-07-14T15:15:08Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}