Skip to content
OpenAdvisories
Low · 2.6 CVE-2024-30261 EUVD-2024-1176GHSA-9qxr-qj54-h672

Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

Published Apr 4, 2024 · Updated Nov 4, 2025 · Assigned by GitHub_M

Vendor: Node.js Product: undici Package: node-undici Package: node-undici Package: nodejs Package: nodejs18 Package: undici Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: npm Ecosystem: Ubuntu

Description

Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

Affected products

VendorProductAffectedFixed
nodejs undici >= 6.0.0, < 6.11.1, < 5.28.4 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 node-undici 5.28.4+dfsg1+~cs23.12.11-1 —
Debian 13 node-undici 5.28.4+dfsg1+~cs23.12.11-1 —
Debian 12 node-undici No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS node-undici No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP5 nodejs18 18.20.1-150400.9.21.3 SUSE-SU-2024:1309-1
SLES 15 SP5 nodejs20 20.12.1-150500.11.9.2 SUSE-SU-2024:1301-1
SLES 15 SP4 nodejs18 18.20.1-150400.9.21.3 SUSE-SU-2024:1309-1
SLES 12 nodejs16 16.20.2-8.45.1 SUSE-SU-2024:1836-1
SLES 12 nodejs18 18.20.1-8.21.1 SUSE-SU-2024:1307-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP4 nodejs18 18.20.1-150400.9.21.3 SUSE-SU-2024:1309-1
SLE HPC 15 SP4 nodejs18 18.20.1-150400.9.21.3 SUSE-SU-2024:1309-1
SUSE Manager Server 4.3 nodejs18 18.20.1-150400.9.21.3 SUSE-SU-2024:1309-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed nodejs-electron 28.2.10-3.1 openSUSE-SU-2024:13855-1
openSUSE Leap 15.5 nodejs18 18.20.1-150400.9.21.3 SUSE-SU-2024:1309-1
openSUSE Leap 15.5 nodejs20 20.12.1-150500.11.9.2 SUSE-SU-2024:1301-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 nodejs +4 1:18.20.2-1.amzn2023.0.1 ALAS2023-2024-694
Amazon Linux 2023 nodejs-npm 1:10.5.0-1.18.20.2.1.amzn2023.0.1 ALAS2023-2024-694
Amazon Linux 2023 nodejs20 +4 1:20.12.2-1.amzn2023.0.2 ALAS2023-2024-594
Amazon Linux 2023 nodejs20-npm 1:10.5.0-1.20.12.2.1.amzn2023.0.2 ALAS2023-2024-594
Amazon Linux 2023 v8-10.2-devel 3:10.2.154.26-1.18.20.2.1.amzn2023.0.1 ALAS2023-2024-694
Amazon Linux 2023 v8-11.3-devel 3:11.3.244.8-1.20.12.2.1.amzn2023.0.2 ALAS2023-2024-594

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 nodejs 20.14.0-1 —
Azure Linux 2 (CBL-Mariner) nodejs18 18.20.2-1 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm undici < 5.28.4 5.28.4 GHSA-9qxr-qj54-h672
npm undici >= 6.0.0, < 6.11.1 6.11.1 GHSA-9qxr-qj54-h672

Advisories 8

References