{
  "cveId": "CVE-2022-35949",
  "url": "https://patchblox.com/security/cve/CVE-2022-35949",
  "summary": "CVE-2022-35949 is fixed in node-undici on 1 platform, first by DEBIAN-CVE-2022-35949, released August 12, 2022. It is not reported as exploited. Patch Radar priority: Urgent.",
  "title": "node-undici: undici is an HTTP/1.1 client, written from scratch for Node.js.\u0060undici\u0060 is vulnerable to SSRF (Server-side Request Fo...",
  "description": "undici is an HTTP/1.1 client, written from scratch for Node.js.\u0060undici\u0060 is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the \u0060path/pathname\u0060 option of \u0060undici.request\u0060. If a user specifies a URL such as \u0060http://127.0.0.1\u0060 or \u0060//127.0.0.1\u0060 \u0060\u0060\u0060js const undici = require(\u0022undici\u0022) undici.request({origin: \u0022http://example.com\u0022, pathname: \u0022//127.0.0.1\u0022}) \u0060\u0060\u0060 Instead of processing the request as \u0060http://example.org//127.0.0.1\u0060 (or \u0060http://example.org/http://127.0.0.1\u0060 when \u0060http://127.0.0.1 is used\u0060), it actually processes the request as \u0060http://127.0.0.1/\u0060 and sends it to \u0060http://127.0.0.1\u0060. If a developer passes in user input into \u0060path\u0060 parameter of \u0060undici.request\u0060, it can result in an _SSRF_ as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL. This issue was fixed in \u0060undici@5.8.1\u0060. The best workaround is to validate user input before passing it to the \u0060undici.request\u0060 call.",
  "published": "2022-08-12T23:15:07Z",
  "severity": "critical",
  "cvss": 9.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.01927,
  "epssPercentile": 0.80086,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "node-undici",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.8.2\u002Bdfsg1\u002B~cs18.9.18.1-1",
      "fix": "DEBIAN-CVE-2022-35949",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-35949",
      "released": "2022-08-12T23:15:07Z"
    },
    {
      "platform": "linux",
      "product": "node-undici",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.8.2\u002Bdfsg1\u002B~cs18.9.18.1-1",
      "fix": "DEBIAN-CVE-2022-35949",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-35949",
      "released": "2022-08-12T23:15:07Z"
    },
    {
      "platform": "linux",
      "product": "node-undici",
      "release": "Debian 14",
      "fixedVersion": "5.8.2\u002Bdfsg1\u002B~cs18.9.18.1-1",
      "fix": "DEBIAN-CVE-2022-35949",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-35949",
      "released": "2022-08-12T23:15:07Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}