CVE-2024-24758

Published: Feb 16, 2024Modified: Jun 17, 2026

4.5

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

Exploitability: 0.9 / Impact: 3.6

Source: NVD

Description

Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected (2)

Products: Nodejs: Undici

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Nodejs Undici	Before 5.28.3
Nodejs Undici	From 6.0.0 to 6.6.1

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (8)

http://www.openwall.com/lists/oss-security/2024/03/11/1

Source: security-advisories@github.com

Third Party Advisory

https://github.com/nodejs/undici/commit/b9da3e40f1f096a06b4caedbb27c2568730434ef

Source: security-advisories@github.com

Patch

https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3

Source: security-advisories@github.com

Vendor Advisory

https://security.netapp.com/advisory/ntap-20240419-0007/

Source: security-advisories@github.com

Third Party Advisory

http://www.openwall.com/lists/oss-security/2024/03/11/1

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://github.com/nodejs/undici/commit/b9da3e40f1f096a06b4caedbb27c2568730434ef

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://security.netapp.com/advisory/ntap-20240419-0007/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.