Vulnerability Description
Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nodejs | Undici | < 5.28.4 |
| Fedoraproject | Fedora | 38 |
Related Weaknesses (CWE)
References
- https://github.com/nodejs/undici/commit/64e3402da4e032e68de46acb52800c9a06aaea3fPatch
- https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75Patch
- https://github.com/nodejs/undici/security/advisories/GHSA-m4v8-wqvr-p9f7PatchVendor Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]Product
- https://lists.fedoraproject.org/archives/list/[email protected]Product
- https://lists.fedoraproject.org/archives/list/[email protected]Product
- https://github.com/nodejs/undici/commit/64e3402da4e032e68de46acb52800c9a06aaea3fPatch
- https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75Patch
- https://github.com/nodejs/undici/security/advisories/GHSA-m4v8-wqvr-p9f7PatchVendor Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]Product
- https://lists.fedoraproject.org/archives/list/[email protected]Product
- https://lists.fedoraproject.org/archives/list/[email protected]Product
- https://security.netapp.com/advisory/ntap-20240905-0008/
FAQ
What is CVE-2024-30260?
CVE-2024-30260 is a vulnerability with a CVSS score of 3.9 (LOW). Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerab...
How severe is CVE-2024-30260?
CVE-2024-30260 has been rated LOW with a CVSS base score of 3.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-30260?
Check the references section above for vendor advisories and patch information. Affected products include: Nodejs Undici, Fedoraproject Fedora.