| Name | CVE-2024-24758 |
| Description | Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1064312 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| node-undici (PTS) | bookworm | 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4 | vulnerable |
| bookworm (security) | 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3 | vulnerable | |
| trixie | 7.3.0+dfsg1+~cs24.12.11-1 | fixed | |
| forky, sid | 7.16.0+dfsg+~cs3.2.0-2 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| node-undici | source | (unstable) | 5.28.4+dfsg1+~cs23.12.11-1 | 1064312 |
[bookworm] - node-undici <no-dsa> (Minor issue)
https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3
https://github.com/nodejs/undici/commit/b9da3e40f1f096a06b4caedbb27c2568730434ef (v6.6.1)
https://github.com/nodejs/undici/commit/d3aa574b1259c1d8d329a0f0f495ee82882b1458 (v5.28.3)