PT-2024-2954 · Node.Js+3 · Undici+3
Linzi Shang
+1
·
Published
2024-04-04
·
Updated
2025-08-12
·
CVE-2024-30260
CVSS v2.0
4.6
Medium
| Vector | AV:N/AC:H/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Undici versions prior to 5.28.4
Undici versions prior to 6.11.1
Description
The issue is related to the Undici HTTP/1.1 client for Node.js, which has a flaw in its authorization procedure. Specifically, Undici clears Authorization and Proxy-Authorization headers for
fetch(), but fails to do so for undici.request(). This could potentially allow a remote attacker to execute arbitrary code.Recommendations
For versions prior to 5.28.4, update to version 5.28.4 or later.
For versions prior to 6.11.1, update to version 6.11.1 or later.
As a temporary workaround, consider using
fetch() instead of undici.request().
Alternatively, disable maxRedirections to minimize the risk of exploitation.Exploit
Fix
Information Disclosure
Incorrect Authorization
Improper Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Debian
Suse
Undici