CVE-2024-30261

Name of the Vulnerable Software and Affected Versions Undici versions prior to 5.28.4 Undici versions prior to 6.11.1

Description The issue is related to insufficient access control in the Undici HTTP/1.1 client for Node.js, allowing a remote attacker to execute arbitrary code by altering the integrity option passed to fetch(). This enables fetch() to accept tampered requests as valid.

Recommendations For versions prior to 5.28.4, update to version 5.28.4 or later. For versions prior to 6.11.1, update to version 6.11.1 or later. As a temporary workaround, ensure that the integrity option cannot be tampered with to minimize the risk of exploitation.