Node.Js · Undici · CVE-2024-30260
**Name of the Vulnerable Software and Affected Versions**
Undici versions prior to 5.28.4
Undici versions prior to 6.11.1
**Description**
The issue is related to the Undici HTTP/1.1 client for Node.js, which has a flaw in its authorization procedure. Specifically, Undici clears Authorization and Proxy-Authorization headers for `fetch()`, but fails to do so for `undici.request()`. This could potentially allow a remote attacker to execute arbitrary code.
**Recommendations**
For versions prior to 5.28.4, update to version 5.28.4 or later.
For versions prior to 6.11.1, update to version 6.11.1 or later.
As a temporary workaround, consider using `fetch()` instead of `undici.request()`.
Alternatively, disable `maxRedirections` to minimize the risk of exploitation.