UBUNTU-CVE-2024-30260

MEDIUM5.5

Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerab

Published Apr 4, 2024

Modified 9 months ago

Details

Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for fetch(), but did not clear them for undici.request(). This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

Affected Packages

node-undici

Ubuntu 24.04 LTS

Affected versions:

5.22.1+dfsg1+~cs20.10.10.2-1ubuntu15.26.3+dfsg1+~cs23.10.12-2

References

REPORT

https://github.com/nodejs/undici/commit/64e3402da4e032e68de46acb52800c9a06aaea3f

REPORT

https://github.com/nodejs/undici/commit/64e3402da4e032e68de46acb52800c9a06aaea3f

REPORT

https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75