CVE-2024-30261 Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect
Attackers can bypass integrity checks in Undici's fetch API, allowing tampered responses to be accepted as valid.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-30261?
CVE-2024-30261 is a low-severity vulnerability in Fedoraproject Fedora, published on 4 Apr 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.
Weakness: CWE-284
Which versions are affected by CVE-2024-30261?
4 open source packages ship an affected version, including undici. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
undici npm | All versions | 5.28.4 |
undici npm | All versions | 5.28.4 |
undici npm | From 6.0.0 | 6.11.1 |
undici npm | From 6.0.0 | 6.11.1 |
Linux distribution packages (1)
nodejs-electron openSUSE:Tumbleweed | All versions | 28.2.10-3.1 |
Products include Fedoraproject Fedora, Nodejs Undici.
How do I fix CVE-2024-30261?
Upgrade undici to a fixed version for your release line: 5.28.4 or 6.11.1.
Is CVE-2024-30261 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-30261 exists.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as AZL-39773, AZL-39819, DEBIAN-CVE-2024-30261, GHSA-9qxr-qj54-h672, ROOT-APP-NPM-CVE-2024-30261, UBUNTU-CVE-2024-30261 and 1 more.