Log in Start free

Vulnerability · Published Apr 4, 2024 · Assigned by GitHub_M

CVE-2024-30261Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

Low 2.6

In plain English

A low-severity improper access control in undici from nodejs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)2.6Low
Exploit odds (30 days)0.8%top 43.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-undicino fix listedDEBIAN-CVE-2024-30261
Debian:13node-undici5.28.4+dfsg1+~cs23.12.11-1DEBIAN-CVE-2024-30261
Debian:14node-undici5.28.4+dfsg1+~cs23.12.11-1DEBIAN-CVE-2024-30261
Ubuntu:24.04:LTSnode-undicino fix listedUBUNTU-CVE-2024-30261
npmundici5.28.4GHSA-9qxr-qj54-h672
npmundici6.11.1GHSA-9qxr-qj54-h672

Affected products (as reported)

VendorProductVersions
nodejs undici >= 6.0.0, < 6.11.1< 5.28.4

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

References