Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Undici client may expose credentials in some requests

CVE-2024-30260 · published 2 years ago
Summary

The Undici HTTP client for Node.js does not remove Authorization and Proxy-Authorization headers when using its request() function, potentially sending those credentials to unintended servers. This can allow sensitive login information to be leaked. Update Undici to version 5.28.4 or later (or 6.11.1 or later) to resolve the issue.

What to do
  • Update GitHub Actions undici to version 5.28.4.
  • Update GitHub Actions undici to version 6.11.1.
  • Update debian node-undici to version 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.aikido.6.
  • Update debian rootio-node-undici to version 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.aikido.6.
  • Update rootio @rootio/undici to version 5.28.4-root.io.1.
  • Update GitHub Actions undici to version 5.28.4-aikido.1.
  • Update debian node-undici to version 5.28.4+dfsg1+~cs23.12.11-1.
  • Update undici to version 5.28.4-aikido.3.
  • Update rootio @rootio/undici to version 5.28.4-root.io.3.
  • Update undici to version 5.28.4-aikido.6.
  • Update rootio @rootio/undici to version 5.28.4-root.io.6.
Affected software
Ecosystem VendorProductAffected versions
npm GitHub Actions undici < 5.28.4
>= 6.0.0, < 6.11.1
Fix: upgrade to 5.28.4
– nodejs undici < 5.28.4
>= 6.0.0, < 6.11.1
cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*
– fedoraproject fedora 38
39
40
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
Root:Debian:12 debian node-undici < 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.aikido.6
Fix: upgrade to 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.aikido.6
Root:Debian:12 debian rootio-node-undici < 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.aikido.6
Fix: upgrade to 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.aikido.6
Root:npm rootio @rootio/undici < 5.28.4-root.io.1
< 5.28.4-root.io.3
< 5.28.4-root.io.6
Fix: upgrade to 5.28.4-root.io.1
Root:npm GitHub Actions undici < 5.28.4-aikido.1
Fix: upgrade to 5.28.4-aikido.1
Debian:12 debian node-undici All versions
Debian:13 debian node-undici < 5.28.4+dfsg1+~cs23.12.11-1
Fix: upgrade to 5.28.4+dfsg1+~cs23.12.11-1
Root:npm – undici < 5.28.4-aikido.3
< 5.28.4-aikido.6
Fix: upgrade to 5.28.4-aikido.3
Original advisory text
CVE-2024-30260 in undici - Patched by Root
Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
CWE-285Improper Authorization
CWE-863Incorrect Authorization
Timeline
Published4 Apr 2024
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-m4v8-wqvr-p9f7 · GHSA
CVE-2024-30260 · NVD
CVE-2024-30260 · OSV
ROOT-OS-DEBIAN-12-CVE-2024-30260 · OSV
ROOT-APP-NPM-CVE-2024-30260 · OSV
DEBIAN-CVE-2024-30260 · OSV
Track software like this
Free during beta