{"id":"CVE-2024-30260","aliases":["AZL-39734","AZL-39803","CLSA-2026-1788560495","DEBIAN-CVE-2024-30260","EUVD-2024-1240","GHSA-m4v8-wqvr-p9f7","OESA-2024-2174","ROOT-APP-NPM-CVE-2024-30260","ROOT-OS-DEBIAN-12-CVE-2024-30260","SUSE-SU-2024:1301-1","SUSE-SU-2024:1307-1","SUSE-SU-2024:1309-1","SUSE-SU-2024:1836-1","SUSE-SU-2024:1837-1","UBUNTU-CVE-2024-30260","openSUSE-SU-2024:13850-1","openSUSE-SU-2024:13851-1","openSUSE-SU-2024:13852-1"],"status":"published","title":"Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline","description":"Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.","severity":{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00728,"percentile":0.54633,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-285","CWE-863"],"published":"2024-04-04T14:20:39Z","modified":"2026-11-02T12:02:15Z","fixes":[{"ecosystem":"npm","package":"undici","fixed_in":["5.28.4","6.11.1"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"nodejs","fixed_in":["20.14.0-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"nodejs18","fixed_in":["18.20.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-undici","fixed_in":["5.28.4+dfsg1+~cs23.12.11-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-undici","fixed_in":["5.28.4+dfsg1+~cs23.12.11-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"undici","fixed_in":["5.28.4-aikido.1","5.28.4-aikido.2","5.28.4-aikido.3","5.28.4-aikido.4","5.28.4-aikido.5","5.28.4-aikido.6"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/undici","fixed_in":["5.28.4-root.io.1","5.28.4-root.io.2","5.28.4-root.io.3","5.28.4-root.io.4","5.28.4-root.io.5","5.28.4-root.io.6"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"node-undici","fixed_in":["5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.2","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.4","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.5","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.aikido.6"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-node-undici","fixed_in":["5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.2","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.4","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.5","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.aikido.6"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"nodejs-electron","fixed_in":["28.2.10-2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.28.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.11.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.14.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.2-1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.1-tuxcare.0"},{"fixed":"5.5.1-tuxcare.1"}]}],"versions":["5.5.1"],"bundled":14},{"source":"osv","ecosystem":"Debian:12","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0+dfsg1+~cs20.10.9.3-1","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u2","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4","5.19.1+dfsg1+~cs20.10.9.5-1","5.19.1+dfsg1+~cs20.10.9.5-2","5.22.1+dfsg1+~cs20.10.10.2-1","5.26.3+dfsg1+~cs23.10.12-1","5.26.3+dfsg1+~cs23.10.12-2","5.26.3+dfsg1+~cs23.10.12-3","5.28.0+dfsg1+~cs23.11.12.3-1","5.28.0+dfsg1+~cs23.11.12.3-2","5.28.2+dfsg1+~cs23.11.12.3-1","5.28.2+dfsg1+~cs23.11.12.3-2","5.28.2+dfsg1+~cs23.11.12.3-3","5.28.2+dfsg1+~cs23.11.12.3-4","5.28.2+dfsg1+~cs23.11.12.3-5","5.28.2+dfsg1+~cs23.11.12.3-6","5.28.4+dfsg1+~cs23.12.11-1","5.28.4+dfsg1+~cs23.12.11-2","7.1.0+dfsg1+~cs24.12.10-1","7.15.0+dfsg+~cs3.2.0-1","7.15.0+dfsg+~cs3.2.0-3","7.16.0+dfsg+~cs3.2.0-1","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.2.3+dfsg1+~cs24.12.11-1","7.2.3+dfsg1+~cs24.12.11-2","7.24.5+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-2","7.24.6+dfsg+~cs3.2.0-3","7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2","8.10.2+dfsg+~cs3.2.2-1","8.12.1+dfsg+~cs3.2.3-1","8.12.2+dfsg+~cs3.2.3-1","8.12.2+dfsg+~cs3.2.3-2","8.5.0+dfsg+~cs3.2.0-1","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.28.4+dfsg1+~cs23.12.11-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.28.4+dfsg1+~cs23.12.11-1"}]}]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.28.4"}]}]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.11.1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.12.1-1.oe2403"}]}],"bundled":4},{"source":"osv","ecosystem":"Root:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.28.4-aikido.1"},{"fixed":"5.28.4-aikido.2"},{"fixed":"5.28.4-aikido.3"},{"fixed":"5.28.4-aikido.4"},{"fixed":"5.28.4-aikido.5"},{"fixed":"5.28.4-aikido.6"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.28.4-root.io.1"},{"fixed":"5.28.4-root.io.2"},{"fixed":"5.28.4-root.io.3"},{"fixed":"5.28.4-root.io.4"},{"fixed":"5.28.4-root.io.5"},{"fixed":"5.28.4-root.io.6"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.2"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.4"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.5"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.aikido.6"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.2"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.4"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.5"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.aikido.6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.12.1-150500.11.9.2"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.12.1-150500.11.9.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.1-8.21.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.1-150400.9.21.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.1-150400.9.21.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.1-150400.9.21.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.1-150400.9.21.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.1-150400.9.21.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.1-150400.9.21.3"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.1-150400.9.21.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-8.45.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.22.1+dfsg1+~cs20.10.10.2-1ubuntu1","5.26.3+dfsg1+~cs23.10.12-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs-electron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.2.10-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.12.1-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.7.2-1.1"}]}],"bundled":3}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"nodejs","product":"undici"},{"vendor":"undici","product":"undici"}],"references":[{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-m4v8-wqvr-p9f7","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/nodejs/undici/commit/64e3402da4e032e68de46acb52800c9a06aaea3f","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P6Q4RGETHVYVHDIQGTJGU5AV6NJEI67E/","tags":["x_transferred","Product","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQVHWAS6WDXXIU7F72XI55VZ2LTZUB33/","tags":["x_transferred","Product","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NC3V3HFZ5MOJRZDY5ZELL6REIRSPFROJ/","tags":["x_transferred","Product","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240905-0008/","tags":["advisory"]},{"url":"https://hackerone.com/reports/2408074","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-30260","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQVHWAS6WDXXIU7F72XI55VZ2LTZUB33","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NC3V3HFZ5MOJRZDY5ZELL6REIRSPFROJ","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P6Q4RGETHVYVHDIQGTJGU5AV6NJEI67E","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20240905-0008","tags":["web"]},{"url":"https://github.com/advisories/GHSA-m4v8-wqvr-p9f7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/30xxx/CVE-2024-30260.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-30260","tags":["advisory"]},{"url":"https://github.com/nodejs/undici","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2174","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27982","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27983","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-30261","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241301-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1220053","tags":["report"]},{"url":"https://bugzilla.suse.com/1222244","tags":["report"]},{"url":"https://bugzilla.suse.com/1222384","tags":["report"]},{"url":"https://bugzilla.suse.com/1222530","tags":["report"]},{"url":"https://bugzilla.suse.com/1222603","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-30260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-30261","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241307-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241309-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241836-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241837-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-30260","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-30260","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-30260","title":"Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline","description":"Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.","status":"published","published":"2024-04-04T15:15:44.653Z","modified":"2025-11-04T16:11:54.904Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:34:07.482552Z"}],"euvd":[{"id":"EUVD-2024-1240","description":"Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.","status":"published","published":"2024-04-04T15:15:44Z","modified":"2025-11-04T16:11:54Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low"}],"updated_at":"2026-11-02T19:49:28.888576Z"}],"ghsa":[{"id":"GHSA-m4v8-wqvr-p9f7","title":"Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline","description":"### Impact\n\nUndici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`.\n\n### Patches\n\nThis has been patched in https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75.\nFixes has been released in v5.28.4 and v6.11.1.\n\n### Workarounds\n\nuse `fetch()` or disable `maxRedirections`.\n\n### References\n\nLinzi Shang reported this.\n\n* https://hackerone.com/reports/2408074\n* https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3","status":"published","published":"2024-04-04T14:20:39Z","modified":"2025-11-04T19:44:30Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low"}],"cwes":["CWE-200","CWE-285","CWE-863"],"updated_at":"2026-11-02T14:39:06.376137Z"}],"nvd":[{"id":"CVE-2024-30260","description":"Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.","status":"published","published":"2024-04-04T16:15:08.877Z","modified":"2026-06-17T07:26:37.567Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-285","CWE-863"],"updated_at":"2026-11-02T14:09:48.152273Z"}],"osv":[{"id":"AZL-39734","title":"CVE-2024-30260 affecting package nodejs for versions less than 20.14.0-1","description":"Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.","status":"published","published":"2024-04-04T16:15:08Z","modified":"2026-04-21T04:53:55.253032Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"AZL-39803","title":"CVE-2024-30260 affecting package nodejs18 for versions less than 18.20.2-1","description":"Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.","status":"published","published":"2024-04-04T16:15:08Z","modified":"2026-04-21T04:28:49.564712Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"CVE-2024-30260","title":"Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline","description":"Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.","status":"published","published":"2024-04-04T15:15:44.653Z","modified":"2026-10-28T02:30:26.858652339Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T15:44:40.06138Z"},{"id":"DEBIAN-CVE-2024-30260","description":"Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.","status":"published","published":"2024-04-04T16:15:08.877Z","modified":"2026-11-02T12:02:15.260059702Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"GHSA-m4v8-wqvr-p9f7","title":"Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline","description":"### Impact\n\nUndici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`.\n\n### Patches\n\nThis has been patched in https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75.\nFixes has been released in v5.28.4 and v6.11.1.\n\n### Workarounds\n\nuse `fetch()` or disable `maxRedirections`.\n\n### References\n\nLinzi Shang reported this.\n\n* https://hackerone.com/reports/2408074\n* https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3","status":"published","published":"2024-04-04T14:20:39Z","modified":"2025-11-04T19:44:28Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low"}],"cwes":["CWE-200","CWE-285","CWE-863"],"updated_at":"2026-11-02T15:46:51.463834Z"},{"id":"OESA-2024-2174","title":"nodejs security update","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment, it executes JavaScript code outside of a browser.\r\n\r\nSecurity Fix(es):\r\n\r\nThe team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first.(CVE-2024-27982)\r\n\r\nAn attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.(CVE-2024-27983)\r\n\r\nUndici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.\n(CVE-2024-30260)\r\n\r\nUndici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.(CVE-2024-30261)","status":"published","published":"2024-09-27T11:07:38Z","modified":"2026-08-18T01:17:33.162812531Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"UBUNTU-CVE-2024-30260","description":"Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.","status":"published","published":"2024-04-04T16:15:00Z","modified":"2025-09-08T17:00:21Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"CLSA-2026-1788560495","title":"TuxCare security update for undici (14 CVEs)","description":"TuxCare rebuilt undici to address 14 CVEs. Fixed in 5.5.1-tuxcare.1.","status":"published","published":"2026-09-04T22:21:35Z","modified":"2026-10-15T09:48:03.135244229Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"openSUSE-SU-2024:13850-1","title":"nodejs-electron-28.2.10-2.1 on GA media","description":"These are all security issues fixed in the nodejs-electron-28.2.10-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:30:55.213648Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:13851-1","title":"corepack20-20.12.1-1.1 on GA media","description":"These are all security issues fixed in the corepack20-20.12.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:12:35.407337Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:13852-1","title":"corepack21-21.7.2-1.1 on GA media","description":"These are all security issues fixed in the corepack21-21.7.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:21:48.655992Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"ROOT-APP-NPM-CVE-2024-30260","title":"CVE-2024-30260 in undici - Patched by Root","description":"Root has patched CVE-2024-30260 in the undici package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-27T16:02:30Z","modified":"2026-10-27T17:15:03.430746555Z","updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2024-30260","title":"CVE-2024-30260 in node-undici - Patched by Root","description":"Root has patched CVE-2024-30260 in the node-undici package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-25T12:14:35Z","modified":"2026-08-26T01:12:42.992427113Z","updated_at":"2026-11-02T15:53:30.70924Z"},{"id":"SUSE-SU-2024:1301-1","title":"Security update for nodejs20","description":"This update for nodejs20 fixes the following issues:\n\nUpdate to 20.12.1\n\nSecurity fixes:\n\n - CVE-2024-27983: Fixed failed assertion in node::http2::Http2Session::~Http2Session() that could lead to HTTP/2 server crash (bsc#1222244)\n - CVE-2024-27982: Fixed HTTP Request Smuggling via Content Length Obfuscation (bsc#1222384)\n - CVE-2024-30260: Fixed proxy-authorization header not cleared on cross-origin redirect in undici (bsc#1222530)\n - CVE-2024-30261: Fixed fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect in undici (bsc#1222603)  \n - CVE-2024-24806: Fixed improper domain lookup that potentially leads to SSRF attacks in libuv (bsc#1220053)\n","status":"published","published":"2024-04-16T01:33:32Z","modified":"2026-02-04T04:24:48.480942Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1307-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\nUpdate to 18.20.1\n\nSecurity fixes:\n - CVE-2024-27983: Fixed failed assertion in node::http2::Http2Session::~Http2Session() that could lead to HTTP/2 server crash (bsc#1222244)\n - CVE-2024-27982: Fixed HTTP Request Smuggling via Content Length Obfuscation (bsc#1222384)\n - CVE-2024-30260: Fixed proxy-authorization header not cleared on cross-origin redirect in undici (bsc#1222530)\n - CVE-2024-30261: Fixed fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect in undici (bsc#1222603)  \n - CVE-2024-24806: Fixed improper domain lookup that potentially leads to SSRF attacks in libuv (bsc#1220053)\n","status":"published","published":"2024-04-16T09:32:01Z","modified":"2025-05-02T04:36:31.314523Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1309-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\nUpdate to 18.20.1\n\nSecurity fixes:\n\n - CVE-2024-27983: Fixed failed assertion in node::http2::Http2Session::~Http2Session() that could lead to HTTP/2 server crash (bsc#1222244)\n - CVE-2024-27982: Fixed HTTP Request Smuggling via Content Length Obfuscation (bsc#1222384)\n - CVE-2024-30260: Fixed proxy-authorization header not cleared on cross-origin redirect in undici (bsc#1222530)\n - CVE-2024-30261: Fixed fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect in undici (bsc#1222603)  \n - CVE-2024-24806: Fixed improper domain lookup that potentially leads to SSRF attacks in libuv (bsc#1220053)\n","status":"published","published":"2024-04-16T09:32:58Z","modified":"2025-05-02T04:36:31.375867Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1836-1","title":"Security update for nodejs16","description":"This update for nodejs16 fixes the following issues:\n\n- CVE-2024-30260: undici: proxy-authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline (bsc#1222530)\n- CVE-2024-30261: undici: Ensure that integrity cannot be tampered with (bsc#1222603)\n","status":"published","published":"2024-05-29T12:10:53Z","modified":"2026-02-04T04:03:57.377714Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1837-1","title":"Security update for nodejs16","description":"This update for nodejs16 fixes the following issues:\n\n- CVE-2024-30260: undici: proxy-authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline (bsc#1222530)\n- CVE-2024-30261: undici: Ensure that integrity cannot be tampered with (bsc#1222603)\n","status":"published","published":"2024-05-29T12:11:02Z","modified":"2026-02-04T04:26:16.983675Z","updated_at":"2026-11-02T15:53:54.652421Z"}]}}