CVE-2024-24758 Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici

What is CVE-2024-24758?

CVE-2024-24758 is a low-severity vulnerability in Nodejs Undici, published on 16 Feb 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness: CWE-200

Which versions are affected by CVE-2024-24758?

4 open source packages ship an affected version, including undici. It affects 1 product.

Products include Nodejs Undici.

How do I fix CVE-2024-24758?

Upgrade undici to a fixed version for your release line: 5.28.3 or 6.6.1.

Is CVE-2024-24758 being exploited?

There is no known exploitation of CVE-2024-24758 in the wild and no public exploit code.

Other vulnerabilities in Nodejs Undici

• CVE-2026-109855 undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake High 7.5
• CVE-2026-109869 undici vulnerable to Denial of Service via unhandled error on excessive content-encodings High 7.5
• CVE-2026-87018 undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation High 7.5
• CVE-2026-19534 undici vulnerable to Denial of Service via unrequested WebSocket subprotocol High 7.5
• CVE-2026-12151 undici WebSocket client vulnerable to denial of service via fragment count bypass High 7.5

All Nodejs Undici vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-35045, BELL-CVE-2024-24758, DEBIAN-CVE-2024-24758, GHSA-3787-6prv-h9w3, ROOT-OS-DEBIAN-12-CVE-2024-24758, UBUNTU-CVE-2024-24758.