CVE-2022-32210: 
JavaScript vulnerability analysis and mitigation

CVE-2022-32210 affects Undici's ProxyAgent functionality, discovered and disclosed in June 2022. The vulnerability impacts versions from 4.8.2 up to (excluding) 5.5.1 of the Undici HTTP/1.1 client for Node.js. This security flaw involves improper certificate validation in the ProxyAgent component (GitHub Advisory).

The vulnerability stems from Undici.ProxyAgent's failure to verify remote server certificates and its exposure of all request and response data to the proxy. The issue has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N. It is classified under CWE-295 (Improper Certificate Validation) (NVD).

The vulnerability allows proxies to perform Man-in-the-Middle (MITM) attacks on all HTTPS traffic. When using HTTP proxies, HTTPS requests are transmitted in plain text between Undici and the proxy server, effectively removing all HTTPS security. This enables potential MITM attacks by any entity on the network path between the client and target server, including local network users, ISPs, and the proxy itself (GitHub Advisory).

The vulnerability was patched in Undici version 5.5.1. Prior to the patch, the only workaround was to avoid using ProxyAgent as a dispatcher for TLS Connections (GitHub Advisory).