Vulnerability · Published Feb 16, 2024 · Assigned by GitHub_M
CVE-2024-24758Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici
Low 3.9
In plain English
A low-severity information exposure in undici from nodejs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | node-undici | no fix listed | DEBIAN-CVE-2024-24758 |
| Debian:13 | node-undici | 5.28.4+dfsg1+~cs23.12.11-1 | DEBIAN-CVE-2024-24758 |
| Debian:14 | node-undici | 5.28.4+dfsg1+~cs23.12.11-1 | DEBIAN-CVE-2024-24758 |
| Ubuntu:24.04:LTS | node-undici | no fix listed | UBUNTU-CVE-2024-24758 |
| Ubuntu:25.10 | node-undici | no fix listed | UBUNTU-CVE-2024-24758 |
| Ubuntu:26.04:LTS | node-undici | no fix listed | UBUNTU-CVE-2024-24758 |
| Ubuntu:26.10 | node-undici | no fix listed | UBUNTU-CVE-2024-24758 |
| npm | undici | 6.6.1 | GHSA-3787-6prv-h9w3 |
| npm | undici | 5.28.3 | GHSA-3787-6prv-h9w3 |
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L
References
- https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3 x_refsource_CONFIRM
- https://github.com/nodejs/undici/commit/b9da3e40f1f096a06b4caedbb27c2568730434ef x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20240419-0007/
- http://www.openwall.com/lists/oss-security/2024/03/11/1