{"id":"CVE-2024-24758","aliases":["AZL-35045","BELL-CVE-2024-24758","CLSA-2026-1788560495","DEBIAN-CVE-2024-24758","EUVD-2024-0479","GHSA-3787-6prv-h9w3","ROOT-OS-DEBIAN-12-CVE-2024-24758","SUSE-SU-2024:0643-1","SUSE-SU-2024:0644-1","SUSE-SU-2024:0728-1","SUSE-SU-2024:0729-1","SUSE-SU-2024:0730-1","SUSE-SU-2024:0731-1","UBUNTU-CVE-2024-24758","openSUSE-SU-2024:13697-1","openSUSE-SU-2024:13698-1"],"status":"published","title":"Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici","description":"Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","severity":{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00765,"percentile":0.55767,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2024-02-16T09:26:05.371851Z","modified":"2026-11-02T12:01:34Z","fixes":[{"ecosystem":"npm","package":"undici","fixed_in":["5.28.3","6.6.1"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"nodejs","fixed_in":["20.14.0-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"nodejs","fixed_in":["18.19.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nodejs","fixed_in":["20.11.1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"nodejs","fixed_in":["18.19.1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs","fixed_in":["20.11.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-undici","fixed_in":["5.28.4+dfsg1+~cs23.12.11-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-undici","fixed_in":["5.28.4+dfsg1+~cs23.12.11-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"node-undici","fixed_in":["5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.2","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.4","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.5","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.aikido.6"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-node-undici","fixed_in":["5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.2","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.4","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.5","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.aikido.6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.28.2"},{"fixed":"5.28.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"last_affected":"6.6.0"},{"fixed":"6.6.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.14.0-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.16.0-r0"},{"fixed":"18.19.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.16.1-r0"},{"fixed":"20.11.1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.16.0-r0"},{"fixed":"18.19.1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.16.1-r0"},{"fixed":"20.11.1-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.1-tuxcare.0"},{"fixed":"5.5.1-tuxcare.1"}]}],"versions":["5.5.1"],"bundled":14},{"source":"osv","ecosystem":"Debian:12","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0+dfsg1+~cs20.10.9.3-1","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u2","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4","5.19.1+dfsg1+~cs20.10.9.5-1","5.19.1+dfsg1+~cs20.10.9.5-2","5.22.1+dfsg1+~cs20.10.10.2-1","5.26.3+dfsg1+~cs23.10.12-1","5.26.3+dfsg1+~cs23.10.12-2","5.26.3+dfsg1+~cs23.10.12-3","5.28.0+dfsg1+~cs23.11.12.3-1","5.28.0+dfsg1+~cs23.11.12.3-2","5.28.2+dfsg1+~cs23.11.12.3-1","5.28.2+dfsg1+~cs23.11.12.3-2","5.28.2+dfsg1+~cs23.11.12.3-3","5.28.2+dfsg1+~cs23.11.12.3-4","5.28.2+dfsg1+~cs23.11.12.3-5","5.28.2+dfsg1+~cs23.11.12.3-6","5.28.4+dfsg1+~cs23.12.11-1","5.28.4+dfsg1+~cs23.12.11-2","7.1.0+dfsg1+~cs24.12.10-1","7.15.0+dfsg+~cs3.2.0-1","7.15.0+dfsg+~cs3.2.0-3","7.16.0+dfsg+~cs3.2.0-1","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.2.3+dfsg1+~cs24.12.11-1","7.2.3+dfsg1+~cs24.12.11-2","7.24.5+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-2","7.24.6+dfsg+~cs3.2.0-3","7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2","8.10.2+dfsg+~cs3.2.2-1","8.12.1+dfsg+~cs3.2.3-1","8.12.2+dfsg+~cs3.2.3-1","8.12.2+dfsg+~cs3.2.3-2","8.5.0+dfsg+~cs3.2.0-1","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.28.4+dfsg1+~cs23.12.11-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.28.4+dfsg1+~cs23.12.11-1"}]}]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.28.3"}]}]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.6.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.2"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.4"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.5"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.aikido.6"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.2"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.4"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.5"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.aikido.6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.11.1-150500.11.6.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.11.1-150500.11.6.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.19.1-8.18.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150400.3.30.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150400.3.30.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150400.3.30.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150400.3.30.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150400.3.30.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150300.7.33.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150300.7.33.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150300.7.33.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150300.7.33.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.19.1-150400.9.18.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.19.1-150400.9.18.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.19.1-150400.9.18.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.19.1-150400.9.18.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.19.1-150400.9.18.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.19.1-150400.9.18.2"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.19.1-150400.9.18.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-8.39.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.22.1+dfsg1+~cs20.10.10.2-1ubuntu1","5.26.3+dfsg1+~cs23.10.12-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.18.2+dfsg+~cs3.2.0-1build1","7.24.6+dfsg+~cs3.2.0-3","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.3.0+dfsg1+~cs24.12.11-2","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.18.2+dfsg+~cs3.2.0-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.11.1-1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.6.2-1.1"}]}],"bundled":9}],"products":[{"vendor":"nodejs","product":"undici"},{"vendor":"undici","product":"undici"}],"references":[{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/nodejs/undici/commit/b9da3e40f1f096a06b4caedbb27c2568730434ef","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20240419-0007/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/11/1","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://github.com/nodejs/undici/commit/d3aa574b1259c1d8d329a0f0f495ee82882b1458","tags":["web","report"]},{"url":"https://github.com/nodejs/undici/releases/tag/v5.28.3","tags":["web"]},{"url":"https://github.com/nodejs/undici/releases/tag/v6.6.1","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24758","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240419-0007","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3787-6prv-h9w3"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-24758","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2024-18","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24758.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-24758","tags":["advisory"]},{"url":"https://github.com/nodejs/undici","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240643-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1219152","tags":["report"]},{"url":"https://bugzilla.suse.com/1219724","tags":["report"]},{"url":"https://bugzilla.suse.com/1219992","tags":["report"]},{"url":"https://bugzilla.suse.com/1219993","tags":["report"]},{"url":"https://bugzilla.suse.com/1219994","tags":["report"]},{"url":"https://bugzilla.suse.com/1219995","tags":["report"]},{"url":"https://bugzilla.suse.com/1219997","tags":["report"]},{"url":"https://bugzilla.suse.com/1219998","tags":["report"]},{"url":"https://bugzilla.suse.com/1219999","tags":["report"]},{"url":"https://bugzilla.suse.com/1220014","tags":["report"]},{"url":"https://bugzilla.suse.com/1220017","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24806","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240644-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240728-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1220053","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240729-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240730-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240731-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-24758","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24758","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2024/03/11/1","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-24758","title":"Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici","description":"Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-02-16T21:40:37.716Z","modified":"2025-02-13T17:40:21.66Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:34:13.991836Z"}],"euvd":[{"id":"EUVD-2024-0479","description":"Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-02-16T21:40:37Z","modified":"2025-02-13T17:40:21Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low"}],"updated_at":"2026-11-03T00:03:47.088299Z"}],"ghsa":[{"id":"GHSA-3787-6prv-h9w3","title":"Undici proxy-authorization header not cleared on cross-origin redirect in fetch","description":"### Impact\n\nUndici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authorization` headers. \n\n### Patches\n\nThis is patched in v5.28.3 and v6.6.1\n\n### Workarounds\n\nThere are no known workarounds.\n\n### References\n\n- https://fetch.spec.whatwg.org/#authentication-entries\n- https://github.com/nodejs/undici/security/advisories/GHSA-wqq4-5wpv-mx2g","status":"published","published":"2024-02-16T16:02:52Z","modified":"2026-03-18T05:06:59Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:39:37.554665Z"}],"nvd":[{"id":"CVE-2024-24758","description":"Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-02-16T22:15:08.16Z","modified":"2026-06-17T07:14:48.017Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:09:37.655131Z"}],"osv":[{"id":"AZL-35045","title":"CVE-2024-24758 affecting package nodejs for versions less than 20.14.0-1","description":"Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-02-16T22:15:08Z","modified":"2026-04-21T04:33:25.182741Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"BELL-CVE-2024-24758","status":"published","published":"2024-02-16T09:26:05.371851Z","modified":"2026-02-18T07:28:07.602495Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:19.288949Z"},{"id":"CVE-2024-24758","title":"Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici","description":"Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-02-16T21:40:37.716Z","modified":"2026-10-28T02:30:50.726699817Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:38.897406Z"},{"id":"DEBIAN-CVE-2024-24758","description":"Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-02-16T22:15:08.16Z","modified":"2026-11-02T12:01:34.569377957Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"GHSA-3787-6prv-h9w3","title":"Undici proxy-authorization header not cleared on cross-origin redirect in fetch","description":"### Impact\n\nUndici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authorization` headers. \n\n### Patches\n\nThis is patched in v5.28.3 and v6.6.1\n\n### Workarounds\n\nThere are no known workarounds.\n\n### References\n\n- https://fetch.spec.whatwg.org/#authentication-entries\n- https://github.com/nodejs/undici/security/advisories/GHSA-wqq4-5wpv-mx2g","status":"published","published":"2024-02-16T16:02:52Z","modified":"2026-09-10T03:50:05.188938975Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"UBUNTU-CVE-2024-24758","description":"Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-02-16T22:15:00Z","modified":"2026-10-17T12:56:43.424263385Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low"},{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:42.68848Z"},{"id":"CLSA-2026-1788560495","title":"TuxCare security update for undici (14 CVEs)","description":"TuxCare rebuilt undici to address 14 CVEs. Fixed in 5.5.1-tuxcare.1.","status":"published","published":"2026-09-04T22:21:35Z","modified":"2026-10-15T09:48:03.135244229Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"openSUSE-SU-2024:13697-1","title":"corepack20-20.11.1-1.1 on GA media","description":"These are all security issues fixed in the corepack20-20.11.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:55:47.667066Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:13698-1","title":"corepack21-21.6.2-1.1 on GA media","description":"These are all security issues fixed in the corepack21-21.6.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:38:16.290264Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2024-24758","title":"CVE-2024-24758 in node-undici - Patched by Root","description":"Root has patched CVE-2024-24758 in the node-undici package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-25T12:14:35Z","modified":"2026-08-26T01:12:42.274777561Z","updated_at":"2026-11-02T15:53:30.70924Z"},{"id":"SUSE-SU-2024:0643-1","title":"Security update for nodejs20","description":"This update for nodejs20 fixes the following issues:\n\nUpdate to 20.11.1: (security updates)\n\n* CVE-2024-21892: Code injection and privilege escalation through Linux capabilities (bsc#1219992).\n* CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993).\n* CVE-2024-21896: Path traversal by monkey-patching Buffer internals (bsc#1219994).j\n* CVE-2024-22017: setuid() does not drop all privileges due to io_uring (bsc#1219995).\n* CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997).\n* CVE-2024-21891: Multiple permission model bypasses due to improper path traversal sequence sanitization (bsc#1219998).\n* CVE-2024-21890: Improper handling of wildcards in --allow-fs-read and --allow-fs-write (bsc#1219999).\n* CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014).\n* CVE-2024-24758: undici version 5.28.3 (bsc#1220017).\n* CVE-2024-24806: libuv version 1.48.0 (bsc#1219724).\n\nUpdate to 20.11.0:\n\n* esm: add import.meta.dirname and import.meta.filename\n* fs: add c++ fast path for writeFileSync utf8\n* module: remove useCustomLoadersIfPresent flag\n* module: bootstrap module loaders in shadow realm\n* src: add --disable-warning option\n* src: create per isolate proxy env template\n* src: make process binding data weak\n* stream: use Array for Readable buffer\n* stream: optimize creation\n* test_runner: adds built in lcov reporter\n* test_runner: add Date to the supported mock APIs\n* test_runner, cli: add --test-timeout flag\n\nUpdate to 20.10.0:\n\n* --experimental-default-type flag to flip module defaults\n* The new flag --experimental-detect-module can be used to automatically run ES modules when their syntax can be detected.\n* Added flush option in file system functions for fs.writeFile functions\n* Added experimental WebSocket client\n* vm: fix V8 compilation cache support for vm.Script. This fixes performance regression since v16.x when support for importModuleDynamically was added to vm.Script\n","status":"published","published":"2024-02-28T08:43:43Z","modified":"2026-02-04T04:14:35.479433Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0644-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\nUpdate to 18.19.1: (security updates)\n\n* CVE-2024-21892: Code injection and privilege escalation through Linux capabilities (bsc#1219992).\n* CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993).\n* CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997).\n* CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014).\n* CVE-2024-24758: undici version 5.28.3 (bsc#1220017).\n* CVE-2024-24806: libuv version 1.48.0 (bsc#1219724).\n\n\nUpdate to LTS version 18.19.0\n\n* deps: npm updates to 10.x\n* esm:\n  + Leverage loaders when resolving subsequent loaders\n  + import.meta.resolve unflagged\n  + --experimental-default-type flag to flip module defaults\n","status":"published","published":"2024-02-28T08:43:54Z","modified":"2026-02-04T03:24:05.295121Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0728-1","title":"Security update for nodejs16","description":"This update for nodejs16 fixes the following issues:\n\nSecurity issues fixed:\n\n* CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997).\n* CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993).\n* CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014).\n* CVE-2024-24758: ignore proxy-authorization header (bsc#1220017).\n* CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724).\n","status":"published","published":"2024-02-29T12:00:10Z","modified":"2026-02-04T03:52:10.618962Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0729-1","title":"Security update for nodejs16","description":"This update for nodejs16 fixes the following issues:\n\nSecurity issues fixed:\n\n* CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997).\n* CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993).\n* CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014).\n* CVE-2024-24758: ignore proxy-authorization header (bsc#1220017).\n* CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724).\n","status":"published","published":"2024-02-29T12:00:23Z","modified":"2026-02-04T03:36:14.46951Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0730-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\nUpdate to 18.19.1: (security updates)\n\n* CVE-2024-21892: Code injection and privilege escalation through Linux capabilities (bsc#1219992).\n* CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993).\n* CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997).\n* CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014).\n* CVE-2024-24758: undici version 5.28.3 (bsc#1220017).\n* CVE-2024-24806: libuv version 1.48.0 (bsc#1219724).\n\nUpdate to LTS version 18.19.0\n\n* deps: npm updates to 10.x\n* esm:\n  + Leverage loaders when resolving subsequent loaders\n  + import.meta.resolve unflagged\n  + --experimental-default-type flag to flip module defaults\n","status":"published","published":"2024-02-29T12:00:44Z","modified":"2026-02-04T04:26:23.326252Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0731-1","title":"Security update for nodejs16","description":"This update for nodejs16 fixes the following issues:\n\nSecurity issues fixed:\n\n* CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997).\n* CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993).\n* CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014).\n* CVE-2024-24758: ignore proxy-authorization header (bsc#1220017).\n* CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724).\n","status":"published","published":"2024-02-29T12:01:07Z","modified":"2026-02-04T02:41:11.113618Z","updated_at":"2026-11-02T15:53:54.239786Z"}]}}