{"id":"CVE-2024-30261","aliases":["AZL-39773","AZL-39819","DEBIAN-CVE-2024-30261","EUVD-2024-1176","GHSA-9qxr-qj54-h672","OESA-2024-2174","ROOT-APP-NPM-CVE-2024-30261","SUSE-SU-2024:1301-1","SUSE-SU-2024:1307-1","SUSE-SU-2024:1309-1","SUSE-SU-2024:1836-1","SUSE-SU-2024:1837-1","UBUNTU-CVE-2024-30261","openSUSE-SU-2024:13855-1"],"status":"published","title":"Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect","description":"Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.","severity":{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00803,"percentile":0.56967,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2024-04-04T14:20:54Z","modified":"2026-11-02T12:02:06Z","fixes":[{"ecosystem":"npm","package":"undici","fixed_in":["5.28.4","6.11.1"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"nodejs","fixed_in":["20.14.0-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"nodejs18","fixed_in":["18.20.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-undici","fixed_in":["5.28.4+dfsg1+~cs23.12.11-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-undici","fixed_in":["5.28.4+dfsg1+~cs23.12.11-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"undici","fixed_in":["5.28.4-aikido.1","5.28.4-aikido.2","5.28.4-aikido.3","5.28.4-aikido.4","5.28.4-aikido.5","5.28.4-aikido.6"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/undici","fixed_in":["5.28.4-root.io.1","5.28.4-root.io.2","5.28.4-root.io.3","5.28.4-root.io.4","5.28.4-root.io.5","5.28.4-root.io.6"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"nodejs-electron","fixed_in":["28.2.10-3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.28.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.11.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.14.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.2-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0+dfsg1+~cs20.10.9.3-1","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u2","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4","5.19.1+dfsg1+~cs20.10.9.5-1","5.19.1+dfsg1+~cs20.10.9.5-2","5.22.1+dfsg1+~cs20.10.10.2-1","5.26.3+dfsg1+~cs23.10.12-1","5.26.3+dfsg1+~cs23.10.12-2","5.26.3+dfsg1+~cs23.10.12-3","5.28.0+dfsg1+~cs23.11.12.3-1","5.28.0+dfsg1+~cs23.11.12.3-2","5.28.2+dfsg1+~cs23.11.12.3-1","5.28.2+dfsg1+~cs23.11.12.3-2","5.28.2+dfsg1+~cs23.11.12.3-3","5.28.2+dfsg1+~cs23.11.12.3-4","5.28.2+dfsg1+~cs23.11.12.3-5","5.28.2+dfsg1+~cs23.11.12.3-6","5.28.4+dfsg1+~cs23.12.11-1","5.28.4+dfsg1+~cs23.12.11-2","7.1.0+dfsg1+~cs24.12.10-1","7.15.0+dfsg+~cs3.2.0-1","7.15.0+dfsg+~cs3.2.0-3","7.16.0+dfsg+~cs3.2.0-1","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.2.3+dfsg1+~cs24.12.11-1","7.2.3+dfsg1+~cs24.12.11-2","7.24.5+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-2","7.24.6+dfsg+~cs3.2.0-3","7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2","8.10.2+dfsg+~cs3.2.2-1","8.12.1+dfsg+~cs3.2.3-1","8.12.2+dfsg+~cs3.2.3-1","8.12.2+dfsg+~cs3.2.3-2","8.5.0+dfsg+~cs3.2.0-1","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.28.4+dfsg1+~cs23.12.11-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.28.4+dfsg1+~cs23.12.11-1"}]}]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.28.4"}]}]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.11.1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.12.1-1.oe2403"}]}],"bundled":4},{"source":"osv","ecosystem":"Root:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.28.4-aikido.1"},{"fixed":"5.28.4-aikido.2"},{"fixed":"5.28.4-aikido.3"},{"fixed":"5.28.4-aikido.4"},{"fixed":"5.28.4-aikido.5"},{"fixed":"5.28.4-aikido.6"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.28.4-root.io.1"},{"fixed":"5.28.4-root.io.2"},{"fixed":"5.28.4-root.io.3"},{"fixed":"5.28.4-root.io.4"},{"fixed":"5.28.4-root.io.5"},{"fixed":"5.28.4-root.io.6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.12.1-150500.11.9.2"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.12.1-150500.11.9.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.1-8.21.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.1-150400.9.21.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.1-150400.9.21.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.1-150400.9.21.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.1-150400.9.21.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.1-150400.9.21.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.1-150400.9.21.3"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.1-150400.9.21.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-8.45.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.22.1+dfsg1+~cs20.10.10.2-1ubuntu1","5.26.3+dfsg1+~cs23.10.12-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs-electron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.2.10-3.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"nodejs","product":"undici"},{"vendor":"undici","product":"undici"}],"references":[{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-9qxr-qj54-h672","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/nodejs/undici/commit/2b39440bd9ded841c93dd72138f3b1763ae26055","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://hackerone.com/reports/2377760","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P6Q4RGETHVYVHDIQGTJGU5AV6NJEI67E/","tags":["x_transferred","Product","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQVHWAS6WDXXIU7F72XI55VZ2LTZUB33/","tags":["x_transferred","Product","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NC3V3HFZ5MOJRZDY5ZELL6REIRSPFROJ/","tags":["x_transferred","Product","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240905-0008/","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-30261","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQVHWAS6WDXXIU7F72XI55VZ2LTZUB33","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P6Q4RGETHVYVHDIQGTJGU5AV6NJEI67E","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NC3V3HFZ5MOJRZDY5ZELL6REIRSPFROJ","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20240905-0008","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9qxr-qj54-h672"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/30xxx/CVE-2024-30261.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-30261","tags":["advisory"]},{"url":"https://github.com/nodejs/undici","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2174","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27982","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27983","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-30260","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241301-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1220053","tags":["report"]},{"url":"https://bugzilla.suse.com/1222244","tags":["report"]},{"url":"https://bugzilla.suse.com/1222384","tags":["report"]},{"url":"https://bugzilla.suse.com/1222530","tags":["report"]},{"url":"https://bugzilla.suse.com/1222603","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-30260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-30261","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241307-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241309-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241836-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241837-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-30261","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-30261","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-30261","title":"Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect","description":"Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.","status":"published","published":"2024-04-04T15:09:11.369Z","modified":"2025-11-04T16:11:56.039Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:34:07.482552Z"}],"euvd":[{"id":"EUVD-2024-1176","description":"Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.","status":"published","published":"2024-04-04T15:09:11Z","modified":"2025-11-04T16:11:56Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T19:49:28.888576Z"}],"ghsa":[{"id":"GHSA-9qxr-qj54-h672","title":"Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect","description":"### Impact\n\nIf an attacker can alter the `integrity` option passed to `fetch()`, they can let `fetch()` accept requests as valid even if they have been tampered.\n\n### Patches\n\nFixed in https://github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3.\nFixes has been released in v5.28.4 and v6.11.1.\n\n\n### Workarounds\n\nEnsure that `integrity` cannot be tampered with.\n\n### References\n\nhttps://hackerone.com/reports/2377760","status":"published","published":"2024-04-04T14:20:54Z","modified":"2025-11-04T19:44:42Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:39:06.376137Z"}],"nvd":[{"id":"CVE-2024-30261","description":"Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.","status":"published","published":"2024-04-04T15:15:39.46Z","modified":"2026-06-17T07:26:37.69Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:09:48.152273Z"}],"osv":[{"id":"AZL-39773","title":"CVE-2024-30261 affecting package nodejs for versions less than 20.14.0-1","description":"Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.","status":"published","published":"2024-04-04T15:15:39Z","modified":"2026-04-21T04:47:56.751949Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"AZL-39819","title":"CVE-2024-30261 affecting package nodejs18 for versions less than 18.20.2-1","description":"Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.","status":"published","published":"2024-04-04T15:15:39Z","modified":"2026-04-21T04:28:49.224436Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"CVE-2024-30261","title":"Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect","description":"Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.","status":"published","published":"2024-04-04T15:09:11.369Z","modified":"2026-10-28T02:30:59.324206451Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:44:40.06138Z"},{"id":"DEBIAN-CVE-2024-30261","description":"Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.","status":"published","published":"2024-04-04T15:15:39.46Z","modified":"2026-11-02T12:02:06.859274876Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"GHSA-9qxr-qj54-h672","title":"Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect","description":"### Impact\n\nIf an attacker can alter the `integrity` option passed to `fetch()`, they can let `fetch()` accept requests as valid even if they have been tampered.\n\n### Patches\n\nFixed in https://github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3.\nFixes has been released in v5.28.4 and v6.11.1.\n\n\n### Workarounds\n\nEnsure that `integrity` cannot be tampered with.\n\n### References\n\nhttps://hackerone.com/reports/2377760","status":"published","published":"2024-04-04T14:20:54Z","modified":"2025-11-04T19:44:42Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:44.225359Z"},{"id":"OESA-2024-2174","title":"nodejs security update","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment, it executes JavaScript code outside of a browser.\r\n\r\nSecurity Fix(es):\r\n\r\nThe team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first.(CVE-2024-27982)\r\n\r\nAn attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.(CVE-2024-27983)\r\n\r\nUndici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.\n(CVE-2024-30260)\r\n\r\nUndici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.(CVE-2024-30261)","status":"published","published":"2024-09-27T11:07:38Z","modified":"2026-08-18T01:17:33.162812531Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"UBUNTU-CVE-2024-30261","description":"Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.","status":"published","published":"2024-04-04T15:15:00Z","modified":"2025-09-08T17:00:21Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low"},{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"openSUSE-SU-2024:13855-1","title":"nodejs-electron-28.2.10-3.1 on GA media","description":"These are all security issues fixed in the nodejs-electron-28.2.10-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:49:29.106404Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"ROOT-APP-NPM-CVE-2024-30261","title":"CVE-2024-30261 in undici - Patched by Root","description":"Root has patched CVE-2024-30261 in the undici package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-27T16:02:30Z","modified":"2026-10-27T17:15:03.429218722Z","updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"SUSE-SU-2024:1301-1","title":"Security update for nodejs20","description":"This update for nodejs20 fixes the following issues:\n\nUpdate to 20.12.1\n\nSecurity fixes:\n\n - CVE-2024-27983: Fixed failed assertion in node::http2::Http2Session::~Http2Session() that could lead to HTTP/2 server crash (bsc#1222244)\n - CVE-2024-27982: Fixed HTTP Request Smuggling via Content Length Obfuscation (bsc#1222384)\n - CVE-2024-30260: Fixed proxy-authorization header not cleared on cross-origin redirect in undici (bsc#1222530)\n - CVE-2024-30261: Fixed fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect in undici (bsc#1222603)  \n - CVE-2024-24806: Fixed improper domain lookup that potentially leads to SSRF attacks in libuv (bsc#1220053)\n","status":"published","published":"2024-04-16T01:33:32Z","modified":"2026-02-04T04:24:48.480942Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1307-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\nUpdate to 18.20.1\n\nSecurity fixes:\n - CVE-2024-27983: Fixed failed assertion in node::http2::Http2Session::~Http2Session() that could lead to HTTP/2 server crash (bsc#1222244)\n - CVE-2024-27982: Fixed HTTP Request Smuggling via Content Length Obfuscation (bsc#1222384)\n - CVE-2024-30260: Fixed proxy-authorization header not cleared on cross-origin redirect in undici (bsc#1222530)\n - CVE-2024-30261: Fixed fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect in undici (bsc#1222603)  \n - CVE-2024-24806: Fixed improper domain lookup that potentially leads to SSRF attacks in libuv (bsc#1220053)\n","status":"published","published":"2024-04-16T09:32:01Z","modified":"2025-05-02T04:36:31.314523Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1309-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\nUpdate to 18.20.1\n\nSecurity fixes:\n\n - CVE-2024-27983: Fixed failed assertion in node::http2::Http2Session::~Http2Session() that could lead to HTTP/2 server crash (bsc#1222244)\n - CVE-2024-27982: Fixed HTTP Request Smuggling via Content Length Obfuscation (bsc#1222384)\n - CVE-2024-30260: Fixed proxy-authorization header not cleared on cross-origin redirect in undici (bsc#1222530)\n - CVE-2024-30261: Fixed fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect in undici (bsc#1222603)  \n - CVE-2024-24806: Fixed improper domain lookup that potentially leads to SSRF attacks in libuv (bsc#1220053)\n","status":"published","published":"2024-04-16T09:32:58Z","modified":"2025-05-02T04:36:31.375867Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1836-1","title":"Security update for nodejs16","description":"This update for nodejs16 fixes the following issues:\n\n- CVE-2024-30260: undici: proxy-authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline (bsc#1222530)\n- CVE-2024-30261: undici: Ensure that integrity cannot be tampered with (bsc#1222603)\n","status":"published","published":"2024-05-29T12:10:53Z","modified":"2026-02-04T04:03:57.377714Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1837-1","title":"Security update for nodejs16","description":"This update for nodejs16 fixes the following issues:\n\n- CVE-2024-30260: undici: proxy-authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline (bsc#1222530)\n- CVE-2024-30261: undici: Ensure that integrity cannot be tampered with (bsc#1222603)\n","status":"published","published":"2024-05-29T12:11:02Z","modified":"2026-02-04T04:26:16.983675Z","updated_at":"2026-11-02T15:53:54.652421Z"}]}}