CVSS 3.1
4.5 mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:NCVE-2024-24758
Medium (4.5) in nodejs undici. EPSS 0.8% chance of exploitation in the next 30 days. Fixed in undici 5.28.3, 6.6.1.
Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
- CWE
- CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- nodejs:undici
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-3787-6prv-h9w3 | npm | undici | <5.28.3 | 5.28.3 |
| GHSA-3787-6prv-h9w3 | npm | undici | >=6.0.0 <6.6.1 | 6.6.1 |
References
- http://www.openwall.com/lists/oss-security/2024/03/11/1
- https://github.com/nodejs/undici/commit/b9da3e40f1f096a06b4caedbb27c2568730434ef
- https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3
- https://security.netapp.com/advisory/ntap-20240419-0007/
- http://www.openwall.com/lists/oss-security/2024/03/11/1