CVE-2024-30260: Fedoraproject Fedora

Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days.

Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

Affected products

• Fedoraproject Fedora: version 38 only; version 39 only; version 40 only
• Node.js Undici: before 5.28.4 (fixed in 5.28.4); from 6.0.0, before 6.11.1 (fixed in 6.11.1)

Published 2024-04-04. Last modified 2026-06-17.