LowGHSA-3787-6prv-h9w3CVE-2024-24758
Undici proxy-authorization header not cleared on cross-origin redirect in fetch
Published 16 Feb 2024 · Updated 10 Sept 2026
Affected packages
undicinpm
- Affected
- <5.28.3
- Fixed in
- 5.28.3
Update to the fixed version for your release line, for example:
npm install undici@5.28.3undicinpm
- Affected
- >=6.0.0 <6.6.1
- Fixed in
- 6.6.1
Update to the fixed version for your release line, for example:
npm install undici@6.6.1Details
Impact
Undici already cleared Authorization headers on cross-origin redirects, but did not clear Proxy-Authorization headers.
Patches
This is patched in v5.28.3 and v6.6.1
Workarounds
There are no known workarounds.
References
- https://fetch.spec.whatwg.org/#authentication-entries
- https://github.com/nodejs/undici/security/advisories/GHSA-wqq4-5wpv-mx2g
Is GHSA-3787-6prv-h9w3 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected undici, and gives you the command that fixes it.
References
- Linkgithub.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3
- Advisorynvd.nist.gov/vuln/detail/CVE-2024-24758
- Linkgithub.com/nodejs/undici/commit/b9da3e40f1f096a06b4caedbb27c2568730434ef
- Linkgithub.com/nodejs/undici/commit/d3aa574b1259c1d8d329a0f0f495ee82882b1458
- Packagegithub.com/nodejs/undici
- Linkgithub.com/nodejs/undici/releases/tag/v5.28.3
- Linkgithub.com/nodejs/undici/releases/tag/v6.6.1
- Linksecurity.netapp.com/advisory/ntap-20240419-0007
- Linkwww.openwall.com/lists/oss-security/2024/03/11/1
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.