Undici Security Vulnerabilities and Issues — Undici CVE List

Lucene search

NodejsUndici

2 matches found

CVE•added 2024/04/04 3:15 p.m.•95 views

CVE-2024-30261

Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the integrity option passed to fetch(), allowing fetch() to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

3.5CVSS4.2AI score0.00175EPSS

CVE•added 2024/04/04 4:15 p.m.•85 views

CVE-2024-30260

Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for fetch(), but did not clear them for undici.request(). This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

4.3CVSS4.8AI score0.00122EPSS