# [CVE-2022-35949]: undici.request vulnerable to SSRF using absolute / protocol-relative URL on pathname

undici.request combined origin with a protocol-relative or absolute pathname, letting user-controlled path input redirect requests to arbitrary hosts like 127.0.0.1.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: haxatron1
- Disclosed: 2022-09-23
- CVE: CVE-2022-35949
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1663788
- Library page: https://bugbountylibrary.com/r/h1%3A1663788
- Tags: area:web domain:web impact:internal-access kind:bounty platform:hackerone sev:medium tech:nodejs technique:parser-differential vuln:ssrf

**Target:** Node.js undici HTTP client request() pathname option
**Root cause:** undici.request concatenated the origin with the pathname without validating that the pathname was relative; a pathname starting with `//host` or `http://host` was parsed as an authority, overriding the intended origin.
**Steps:**
1. `const undici = require("undici")`
2. `undici.request({origin: "http://example.com", pathname: "//127.0.0.1"})`
3. Observe request is sent to `http://127.0.0.1/` instead of `http://example.com//127.0.0.1`
4. Repeat with `pathname: "http://127.0.0.1"` to reach internal host
**Exploitation:** An app passing user input into the path/pathname option of undici.request assumes the hostname is fixed by origin; attacker supplies `//internal-host` or `http://internal-host` to make the server issue requests to internal services.
**Insight:** When an HTTP client merges a base origin with a user-supplied path, test protocol-relative (`//host`) and absolute (`http://host`) path values — URL parsers treat these as authority overrides, not paths.