{"action":"Upgrade undici to 5.28.4 or later.","affected":[{"fixed":"5.28.4","introduced":"0"},{"fixed":"6.11.1","introduced":"6.0.0"}],"component":"undici","cve_ids":["CVE-2024-30260"],"ecosystem":"npm","epss":0.00734,"exploited":false,"fixed_versions":["5.28.4","6.11.1"],"ghsa_id":"GHSA-m4v8-wqvr-p9f7","id":"tcs_01M5KFZJDBWP9P1X2CK6988GTP","modified_at":"2025-11-04T19:44:28Z","published_at":"2024-04-04T14:20:39Z","references":["https://osv.dev/vulnerability/GHSA-m4v8-wqvr-p9f7","https://github.com/nodejs/undici/security/advisories/GHSA-m4v8-wqvr-p9f7","https://nvd.nist.gov/vuln/detail/CVE-2024-30260","https://github.com/nodejs/undici/commit/64e3402da4e032e68de46acb52800c9a06aaea3f","https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75","https://hackerone.com/reports/2408074","https://github.com/nodejs/undici","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQVHWAS6WDXXIU7F72XI55VZ2LTZUB33","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NC3V3HFZ5MOJRZDY5ZELL6REIRSPFROJ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P6Q4RGETHVYVHDIQGTJGU5AV6NJEI67E","https://security.netapp.com/advisory/ntap-20240905-0008"],"severity":{"label":"low","score":3.9},"sources":[{"source":"osv","source_id":"GHSA-m4v8-wqvr-p9f7","url":"https://osv.dev/vulnerability/GHSA-m4v8-wqvr-p9f7"}],"summary":"Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline"}