CVE-2024-24758: Node.js Undici

Medium severity, CVSS 4.5. EPSS: 0.8% chance of exploitation in the next 30 days.

Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

• Node.js Undici: before 5.28.3 (fixed in 5.28.3); from 6.0.0, before 6.6.1 (fixed in 6.6.1)

Published 2024-02-16. Last modified 2026-06-17.