What’s Vulnerable › Vulnerabilities
CVE-2024-30260: Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-04-04 · updated 2026-06-17
- Weakness: CWE-285
Description
Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.
Affected products
- Fedoraproject Fedora: 38, 39, 40
- undici: before 5.28.4; from 6.0.0 before 6.11.1 — fixed in 5.28.4, 6.11.1
- Npm Undici: before 5.28.4; from 6.0.0 before 6.11.1 — fixed in 5.28.4, 6.11.1
How to fix
Upgrade to a fixed version: undici 5.28.4, 6.11.1; Npm Undici 5.28.4, 6.11.1. Check the vendor advisory for mitigations.
References
- https://github.com/nodejs/undici/commit/64e3402da4e032e68de46acb52800c9a06aaea3f
- https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75
- https://github.com/nodejs/undici/security/advisories/GHSA-m4v8-wqvr-p9f7
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQVHWAS6WDXXIU7F72XI55VZ2LTZUB33/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NC3V3HFZ5MOJRZDY5ZELL6REIRSPFROJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P6Q4RGETHVYVHDIQGTJGU5AV6NJEI67E/
- https://github.com/nodejs/undici/commit/64e3402da4e032e68de46acb52800c9a06aaea3f
- https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75
- https://github.com/nodejs/undici/security/advisories/GHSA-m4v8-wqvr-p9f7
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQVHWAS6WDXXIU7F72XI55VZ2LTZUB33/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NC3V3HFZ5MOJRZDY5ZELL6REIRSPFROJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P6Q4RGETHVYVHDIQGTJGU5AV6NJEI67E/
Get alerted when CVE-2024-30260 or the next vulnerability affects your stack