Every CVE Search/ Get API key

CVE-2024-30261

Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

2.6 LowFix available

Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the integrity option passed to fetch(), allowing fetch() to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.80%Up 0.8 points since Apr 5, 2024
90%50%10%1%

What each source reports

CVE List Score used 2.6

Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the integrity option passed to fetch(), allowing fetch() to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

Record
CVE-2024-30261
CVSS 3.1
2.6 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-284
Updated
2026-11-02
EUVDEUVD-2024-1176 2.6

Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the integrity option passed to fetch(), allowing fetch() to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

Record
EUVD-2024-1176
CVSS 3.1
2.6 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-9qxr-qj54-h672 2.6

Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

Impact

If an attacker can alter the integrity option passed to fetch(), they can let fetch() accept requests as valid even if they have been tampered.

Patches

Fixed in https://github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3. Fixes has been released in v5.28.4 and v6.11.1.

Workarounds

Ensure that integrity cannot be tampered with.

References

https://hackerone.com/reports/2377760

Record
GHSA-9qxr-qj54-h672
CVSS 3.1
2.6 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-284
Updated
2026-11-02
NVD 2.6

Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the integrity option passed to fetch(), allowing fetch() to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

Record
CVE-2024-30261
CVSS 3.1
2.6 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS 3.1
3.5 LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-284
Updated
2026-11-02
OSVAZL-39773 3.5

CVE-2024-30261 affecting package nodejs for versions less than 20.14.0-1

Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the integrity option passed to fetch(), allowing fetch() to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

Record
AZL-39773
CVSS 3.1
3.5 LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVAZL-39819 3.5

CVE-2024-30261 affecting package nodejs18 for versions less than 18.20.2-1

Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the integrity option passed to fetch(), allowing fetch() to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

Record
AZL-39819
CVSS 3.1
3.5 LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
Show 12 moreShow less
OSV 2.6

Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the integrity option passed to fetch(), allowing fetch() to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

Record
CVE-2024-30261
CVSS 3.1
2.6 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-284
Updated
2026-11-02
OSVDEBIAN-CVE-2024-30261 3.5

Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the integrity option passed to fetch(), allowing fetch() to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

Record
DEBIAN-CVE-2024-30261
CVSS 3.1
3.5 LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVGHSA-9qxr-qj54-h672 2.6

Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

Impact

If an attacker can alter the integrity option passed to fetch(), they can let fetch() accept requests as valid even if they have been tampered.

Patches

Fixed in https://github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3. Fixes has been released in v5.28.4 and v6.11.1.

Workarounds

Ensure that integrity cannot be tampered with.

References

https://hackerone.com/reports/2377760

Record
GHSA-9qxr-qj54-h672
CVSS 3.1
2.6 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-284
Updated
2026-11-02
OSVOESA-2024-2174 8.2

nodejs security update

Node.js is an open-source, cross-platform, JavaScript runtime environment, it executes JavaScript code outside of a browser.

Security Fix(es):

The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first.(CVE-2024-27982)

An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.(CVE-2024-27983)

Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for fetch(), but did not clear them for undici.request(). This vulnerability was patched in version(s) 5.28.4 and 6.11.1. (CVE-2024-30260)

Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the integrity option passed to fetch(), allowing fetch() to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.(CVE-2024-30261)

Record
OESA-2024-2174
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2024-30261 2.6

Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the integrity option passed to fetch(), allowing fetch() to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

Record
UBUNTU-CVE-2024-30261
CVSS 3.1
2.6 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS 3.1
3.5 LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2024:13855-1 No score

nodejs-electron-28.2.10-3.1 on GA media

These are all security issues fixed in the nodejs-electron-28.2.10-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13855-1
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2024-30261 No score

CVE-2024-30261 in undici - Patched by Root

Root has patched CVE-2024-30261 in the undici package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2024-30261
Updated
2026-11-02
OSVSUSE-SU-2024:1301-1 No score

Security update for nodejs20

This update for nodejs20 fixes the following issues:

Update to 20.12.1

Security fixes:

  • CVE-2024-27983: Fixed failed assertion in node::http2::Http2Session::~Http2Session() that could lead to HTTP/2 server crash (bsc#1222244)
  • CVE-2024-27982: Fixed HTTP Request Smuggling via Content Length Obfuscation (bsc#1222384)
  • CVE-2024-30260: Fixed proxy-authorization header not cleared on cross-origin redirect in undici (bsc#1222530)
  • CVE-2024-30261: Fixed fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect in undici (bsc#1222603)
  • CVE-2024-24806: Fixed improper domain lookup that potentially leads to SSRF attacks in libuv (bsc#1220053)
Record
SUSE-SU-2024:1301-1
Updated
2026-11-02
OSVSUSE-SU-2024:1307-1 No score

Security update for nodejs18

This update for nodejs18 fixes the following issues:

Update to 18.20.1

Security fixes:

  • CVE-2024-27983: Fixed failed assertion in node::http2::Http2Session::~Http2Session() that could lead to HTTP/2 server crash (bsc#1222244)
  • CVE-2024-27982: Fixed HTTP Request Smuggling via Content Length Obfuscation (bsc#1222384)
  • CVE-2024-30260: Fixed proxy-authorization header not cleared on cross-origin redirect in undici (bsc#1222530)
  • CVE-2024-30261: Fixed fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect in undici (bsc#1222603)
  • CVE-2024-24806: Fixed improper domain lookup that potentially leads to SSRF attacks in libuv (bsc#1220053)
Record
SUSE-SU-2024:1307-1
Updated
2026-11-02
OSVSUSE-SU-2024:1309-1 No score

Security update for nodejs18

This update for nodejs18 fixes the following issues:

Update to 18.20.1

Security fixes:

  • CVE-2024-27983: Fixed failed assertion in node::http2::Http2Session::~Http2Session() that could lead to HTTP/2 server crash (bsc#1222244)
  • CVE-2024-27982: Fixed HTTP Request Smuggling via Content Length Obfuscation (bsc#1222384)
  • CVE-2024-30260: Fixed proxy-authorization header not cleared on cross-origin redirect in undici (bsc#1222530)
  • CVE-2024-30261: Fixed fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect in undici (bsc#1222603)
  • CVE-2024-24806: Fixed improper domain lookup that potentially leads to SSRF attacks in libuv (bsc#1220053)
Record
SUSE-SU-2024:1309-1
Updated
2026-11-02
OSVSUSE-SU-2024:1836-1 No score

Security update for nodejs16

This update for nodejs16 fixes the following issues:

  • CVE-2024-30260: undici: proxy-authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline (bsc#1222530)
  • CVE-2024-30261: undici: Ensure that integrity cannot be tampered with (bsc#1222603)
Record
SUSE-SU-2024:1836-1
Updated
2026-11-02
OSVSUSE-SU-2024:1837-1 No score

Security update for nodejs16

This update for nodejs16 fixes the following issues:

  • CVE-2024-30260: undici: proxy-authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline (bsc#1222530)
  • CVE-2024-30261: undici: Ensure that integrity cannot be tampered with (bsc#1222603)
Record
SUSE-SU-2024:1837-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
undici
npm
 before 5.28.4
5.28.4
undici
npm
 6.0.0 up to 6.11.1
6.11.1
nodejs
Azure Linux:3
 before 20.14.0-1
20.14.0-1
nodejs18
Azure Linux:2
 before 18.20.2-1
18.20.2-1
node-undici
Debian:12
 All versions, plus listed versions
5.15.0+dfsg1+~cs20.10.9.3-15.15.0+dfsg1+~cs20.10.9.3-1+deb12u15.15.0+dfsg1+~cs20.10.9.3-1+deb12u25.15.0+dfsg1+~cs20.10.9.3-1+deb12u35.15.0+dfsg1+~cs20.10.9.3-1+deb12u4
Show 38 moreShow less
5.19.1+dfsg1+~cs20.10.9.5-15.19.1+dfsg1+~cs20.10.9.5-25.22.1+dfsg1+~cs20.10.10.2-15.26.3+dfsg1+~cs23.10.12-15.26.3+dfsg1+~cs23.10.12-25.26.3+dfsg1+~cs23.10.12-35.28.0+dfsg1+~cs23.11.12.3-15.28.0+dfsg1+~cs23.11.12.3-25.28.2+dfsg1+~cs23.11.12.3-15.28.2+dfsg1+~cs23.11.12.3-25.28.2+dfsg1+~cs23.11.12.3-35.28.2+dfsg1+~cs23.11.12.3-45.28.2+dfsg1+~cs23.11.12.3-55.28.2+dfsg1+~cs23.11.12.3-65.28.4+dfsg1+~cs23.12.11-15.28.4+dfsg1+~cs23.12.11-27.1.0+dfsg1+~cs24.12.10-17.15.0+dfsg+~cs3.2.0-17.15.0+dfsg+~cs3.2.0-37.16.0+dfsg+~cs3.2.0-17.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-17.2.3+dfsg1+~cs24.12.11-17.2.3+dfsg1+~cs24.12.11-27.24.5+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-27.24.6+dfsg+~cs3.2.0-37.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-28.10.2+dfsg+~cs3.2.2-18.12.1+dfsg+~cs3.2.3-18.12.2+dfsg+~cs3.2.3-18.12.2+dfsg+~cs3.2.3-28.5.0+dfsg+~cs3.2.0-18.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
 None known
node-undici
Debian:13
 before 5.28.4+dfsg1+~cs23.12.11-1
5.28.4+dfsg1+~cs23.12.11-1
node-undici
Debian:14
 before 5.28.4+dfsg1+~cs23.12.11-1
5.28.4+dfsg1+~cs23.12.11-1
nodejs
openEuler:24.03-LTS
From an advisory covering 4 CVEs
 before 20.12.1-1.oe2403
20.12.1-1.oe2403
undici
Root:npm
 before 5.28.4-aikido.1
5.28.4-aikido.15.28.4-aikido.25.28.4-aikido.35.28.4-aikido.45.28.4-aikido.55.28.4-aikido.6
@rootio/undici
Root:npm
 before 5.28.4-root.io.1
5.28.4-root.io.15.28.4-root.io.25.28.4-root.io.35.28.4-root.io.45.28.4-root.io.55.28.4-root.io.6
Show 13 moreShow less
Affected packages
PackageAffectedFixed
nodejs20
SUSE:Linux Enterprise Module for Web and Scripting 15 SP5
From an advisory covering 5 CVEs
 before 20.12.1-150500.11.9.2
20.12.1-150500.11.9.2
nodejs20
openSUSE:Leap 15.5
From an advisory covering 5 CVEs
 before 20.12.1-150500.11.9.2
20.12.1-150500.11.9.2
nodejs18
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 5 CVEs
 before 18.20.1-8.21.1
18.20.1-8.21.1
nodejs18
SUSE:Linux Enterprise Module for Web and Scripting 15 SP5
From an advisory covering 5 CVEs
 before 18.20.1-150400.9.21.3
18.20.1-150400.9.21.3
nodejs18
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 5 CVEs
 before 18.20.1-150400.9.21.3
18.20.1-150400.9.21.3
nodejs18
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 5 CVEs
 before 18.20.1-150400.9.21.3
18.20.1-150400.9.21.3
nodejs18
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 5 CVEs
 before 18.20.1-150400.9.21.3
18.20.1-150400.9.21.3
nodejs18
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 5 CVEs
 before 18.20.1-150400.9.21.3
18.20.1-150400.9.21.3
nodejs18
SUSE:Manager Server 4.3
From an advisory covering 5 CVEs
 before 18.20.1-150400.9.21.3
18.20.1-150400.9.21.3
nodejs18
openSUSE:Leap 15.5
From an advisory covering 5 CVEs
 before 18.20.1-150400.9.21.3
18.20.1-150400.9.21.3
nodejs16
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 2 CVEs
 before 16.20.2-8.45.1
16.20.2-8.45.1
node-undici
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.22.1+dfsg1+~cs20.10.10.2-1ubuntu15.26.3+dfsg1+~cs23.10.12-2
 None known
nodejs-electron
openSUSE:Tumbleweed
 before 28.2.10-3.1
28.2.10-3.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-30261 is a low vulnerability (CVSS 2.6) in Nodejs Undici, published April 4, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.80%, the 56th percentile. Fixed in undici 5.28.4.

References

Show 28 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open