Impact

Undici cleared Authorization and Proxy-Authorization headers for fetch() , but did not clear them for undici.request() .

Patches

This has been patched in nodejs/undici@ 6805746 .
Fixes has been released in v5.28.4 and v6.11.1.

Workarounds

use fetch() or disable maxRedirections .

References

Linzi Shang reported this.

• https://hackerone.com/reports/2408074
• GHSA-3787-6prv-h9w3

References

• GHSA-m4v8-wqvr-p9f7
• nodejs/undici@ 64e3402
• nodejs/undici@ 6805746
• https://hackerone.com/reports/2408074
• https://nvd.nist.gov/vuln/detail/CVE-2024-30260
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQVHWAS6WDXXIU7F72XI55VZ2LTZUB33
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NC3V3HFZ5MOJRZDY5ZELL6REIRSPFROJ
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P6Q4RGETHVYVHDIQGTJGU5AV6NJEI67E