Log in Start free

Vulnerability · Published Apr 4, 2024 · Assigned by GitHub_M

CVE-2024-30260Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline

Low 3.9

In plain English

A low-severity security flaw in undici from nodejs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.9Low
Exploit odds (30 days)0.7%top 45.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-undicino fix listedDEBIAN-CVE-2024-30260
Debian:13node-undici5.28.4+dfsg1+~cs23.12.11-1DEBIAN-CVE-2024-30260
Debian:14node-undici5.28.4+dfsg1+~cs23.12.11-1DEBIAN-CVE-2024-30260
Ubuntu:24.04:LTSnode-undicino fix listedUBUNTU-CVE-2024-30260
npmundici5.28.4GHSA-m4v8-wqvr-p9f7
npmundici6.11.1GHSA-m4v8-wqvr-p9f7

Affected products (as reported)

VendorProductVersions
nodejs undici < 5.28.4>= 6.0.0, < 6.11.1

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

References