CVE-2024-30261: Fedoraproject Fedora

Low severity, CVSS 3.5. EPSS: 0.8% chance of exploitation in the next 30 days.

Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

Affected products

• Fedoraproject Fedora: version 38 only; version 39 only; version 40 only
• Node.js Undici: before 5.28.4 (fixed in 5.28.4); from 6.0.0, before 6.11.1 (fixed in 6.11.1)

Published 2024-04-04. Last modified 2026-06-17.