Skip to content
OpenAdvisories
Low · 3.9 CVE-2024-30260 EUVD-2024-1240GHSA-m4v8-wqvr-p9f7

Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline

Published Apr 4, 2024 · Updated Nov 4, 2025 · Assigned by GitHub_M

Vendor: Node.js Product: undici Package: node-undici Package: node-undici Package: nodejs Package: nodejs18 Package: undici Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: npm Ecosystem: Ubuntu

Description

Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

Affected products

VendorProductAffectedFixed
nodejs undici < 5.28.4, >= 6.0.0, < 6.11.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 node-undici 5.28.4+dfsg1+~cs23.12.11-1 —
Debian 13 node-undici 5.28.4+dfsg1+~cs23.12.11-1 —
Debian 12 node-undici No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS node-undici No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP5 nodejs18 18.20.1-150400.9.21.3 SUSE-SU-2024:1309-1
SLES 15 SP5 nodejs20 20.12.1-150500.11.9.2 SUSE-SU-2024:1301-1
SLES 15 SP4 nodejs18 18.20.1-150400.9.21.3 SUSE-SU-2024:1309-1
SLES 12 nodejs16 16.20.2-8.45.1 SUSE-SU-2024:1836-1
SLES 12 nodejs18 18.20.1-8.21.1 SUSE-SU-2024:1307-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP4 nodejs18 18.20.1-150400.9.21.3 SUSE-SU-2024:1309-1
SLE HPC 15 SP4 nodejs18 18.20.1-150400.9.21.3 SUSE-SU-2024:1309-1
SUSE Manager Server 4.3 nodejs18 18.20.1-150400.9.21.3 SUSE-SU-2024:1309-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed nodejs-electron 28.2.10-2.1 openSUSE-SU-2024:13850-1
openSUSE Tumbleweed nodejs20 20.12.1-1.1 openSUSE-SU-2024:13851-1
openSUSE Tumbleweed nodejs21 21.7.2-1.1 openSUSE-SU-2024:13852-1
openSUSE Leap 15.5 nodejs18 18.20.1-150400.9.21.3 SUSE-SU-2024:1309-1
openSUSE Leap 15.5 nodejs20 20.12.1-150500.11.9.2 SUSE-SU-2024:1301-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 nodejs +4 1:18.20.2-1.amzn2023.0.1 ALAS2023-2024-694
Amazon Linux 2023 nodejs-npm 1:10.5.0-1.18.20.2.1.amzn2023.0.1 ALAS2023-2024-694
Amazon Linux 2023 v8-10.2-devel 3:10.2.154.26-1.18.20.2.1.amzn2023.0.1 ALAS2023-2024-694

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 nodejs 20.14.0-1 —
Azure Linux 2 (CBL-Mariner) nodejs18 18.20.2-1 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm undici < 5.28.4 5.28.4 GHSA-m4v8-wqvr-p9f7
npm undici >= 6.0.0, < 6.11.1 6.11.1 GHSA-m4v8-wqvr-p9f7

Advisories 9

References