[Vulnerability] nodejs/node: Header Injection / Information Disclosure

[github-actions]

Potential Security Vulnerability Detected

Repository: nodejs/node
Commit: a6e9e32
Author: Node.js GitHub Bot
Date: 2026-03-02T00:49:33Z

Commit Message

deps: update undici to 7.22.0

PR-URL: https://github.com/nodejs/node/pull/62035
Reviewed-By: Matthew Aitken <maitken033380023@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>

Pull Request

PR: #62035 - deps: update undici to 7.22.0
Labels: lib / src, author ready, needs-ci, dependencies, dont-land-on-v20.x, dont-land-on-v22.x

Description:
This is an automated update of undici to 7.22.0.

Analysis

Vulnerability Type: Header Injection / Information Disclosure
Severity: Medium

Description

The cache interceptor was spreading result.vary headers directly into revalidation requests without filtering out null values. When a request header specified in the Vary header was absent from the original request, it was stored as null in the cache entry's vary map. Spreading this null value into the revalidation headers could corrupt the header object and potentially send unintended null-valued headers to the server. The patch adds a null-check guard so only present header values are forwarded during revalidation.

Affected Code

if (result.vary) {
  headers = {
    ...headers,
    ...result.vary
  }
}

Proof of Concept

// Server responds with Vary: accept-encoding
// Original request does NOT include accept-encoding header
// Cache stores vary = { 'accept-encoding': null }
// On revalidation, the spread { ...headers, ...result.vary } produces:
// { 'if-modified-since': '...', 'accept-encoding': null }
// Sending a request with a null-valued header could bypass server-side Vary matching
// or cause unexpected behavior in downstream servers/proxies that interpret null differently.
// Trigger: make a cached request without 'accept-encoding', wait for stale-while-revalidate,
// observe the revalidation request incorrectly includes 'accept-encoding: null'

---

This issue was automatically created by Vulnerability Spoiler Alert.
Detected at: 2026-03-02T00:50:37.134Z

[spaceraccoon]

Verification analysis — False positive

Reviewed commit a6e9e32 (deps: update undici to 7.22.0). This is a routine undici dependency version bump — the diff is the whole undici 7.22.0 update (docs, cache handler/interceptors, bundled undici.js, lockfile, version header).

The issue singles out the cache interceptor's vary handling — spreading result.vary (which can contain null for headers absent from the original request) into revalidation request headers. That null-filtering change is a minor correctness fix among a large version bump, not a security vulnerability: a null header value is not "header injection", and there is no attacker-controlled element (the Vary header set comes from the origin server's own response). The commit is a plain deps: bump with no security flag or advisory.

Verdict: false positive — routine undici version bump; the vary null-handling tweak is minor correctness, not a security vulnerability.