Skip to content
Sign in
3.9 Low

CVE-2024-30260 Undici is an HTTP/1.1 client, written from scratch for Node.js

Description

Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

Affected products and versions

Product Affected versions Fixed in
undici 6.0 6.0.0 → < 6.11.1 6.11.1
undici 5.28 earliest → < 5.28.4 5.28.4

Other CVEs of undici

The 15 CVEs of undici →
CVE-2026-22036 Undici is an HTTP/1.1 client for Node.js 5.9 Medium CVE-2025-47279 Undici is an HTTP/1.1 client for Node.js 3.1 Low CVE-2025-22150 Undici is an HTTP/1.1 client 6.8 Medium CVE-2024-38372 Undici is an HTTP/1.1 client, written from scratch for Node.js 2.0 Low
Track this CVE