{"id":"GHSA-m4v8-wqvr-p9f7","summary":"Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline","details":"### Impact\n\nUndici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`.\n\n### Patches\n\nThis has been patched in https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75.\nFixes has been released in v5.28.4 and v6.11.1.\n\n### Workarounds\n\nuse `fetch()` or disable `maxRedirections`.\n\n### References\n\nLinzi Shang reported this.\n\n* https://hackerone.com/reports/2408074\n* https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3","aliases":["CVE-2024-30260"],"modified":"2025-11-04T19:44:28Z","published":"2024-04-04T14:20:39Z","database_specific":{"github_reviewed_at":"2024-04-04T14:20:39Z","nvd_published_at":"2024-04-04T16:15:08Z","cwe_ids":["CWE-200","CWE-285","CWE-863"],"severity":"LOW","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-m4v8-wqvr-p9f7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-30260"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/64e3402da4e032e68de46acb52800c9a06aaea3f"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75"},{"type":"WEB","url":"https://hackerone.com/reports/2408074"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQVHWAS6WDXXIU7F72XI55VZ2LTZUB33"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NC3V3HFZ5MOJRZDY5ZELL6REIRSPFROJ"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P6Q4RGETHVYVHDIQGTJGU5AV6NJEI67E"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20240905-0008"}],"affected":[{"package":{"name":"undici","ecosystem":"npm","purl":"pkg:npm/undici"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.28.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-m4v8-wqvr-p9f7/GHSA-m4v8-wqvr-p9f7.json"}},{"package":{"name":"undici","ecosystem":"npm","purl":"pkg:npm/undici"},"ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.11.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-m4v8-wqvr-p9f7/GHSA-m4v8-wqvr-p9f7.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L"}]}