Timeline

• Sep 23, 2022 CVE Published
• Sep 23, 2022 PoC Published

References

• [CVE-2022-35949]: undici.request vulnerable to SSRF using absolute / protocol-relative URL on pathname advisory