~ / search / GHSA-3787-6prv-h9w3

GHSA-3787-6prv-h9w3

Undici proxy-authorization header not cleared on cross-origin redirect in fetch

Source: GitHub Advisory Database (reviewed) Low CVE-2024-24758

Packages

EcosystemPackageAffectedFixed in
npm undici < 5.28.3 5.28.3
npm undici >= 6.0.0, < 6.6.1 6.6.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authorization` headers. ### Patches This is patched in v5.28.3 and v6.6.1 ### Workarounds There are no known workarounds. ### References - https://fetch.spec.whatwg.org/#authentication-entries - https://github.com/nodejs/undici/security/advisories/GHSA-wqq4-5wpv-mx2g

References

External links from the advisory. They lead to third-party sites.