CVE-2024-30261: Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect
Vulnerability summary
CVE-2024-30261 is a low (CVSS 3.5) Improper Access Control vulnerability in fedoraproject fedora. EPSS estimates a 0.80% chance of exploitation in the next 30 days, higher than 56.7% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 2.6, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 4 · Related 4Timeline
- 04-04-2024PublishedVulnerability first disclosed.
- 04-11-2025Last modifiedVulnerability information updated.
Description
Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.
CVSS metrics
5 scores · 5 sources · 1 version- CVE.orgCNA2.6LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated3.5LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated3.5LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
- OSV · NpmEcosystem advisory · calculated2.6LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:NDiffers
EPSS trend
Probability
0.80%
Chance of exploitation in the next 30 days
Percentile
57%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.80% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- node-undiciAll versions (No fix recorded) | < 5.28.4+dfsg1+~cs23.12.11-1
Fedoraproject1 product
- fedoraEOL38 | 39 | 40
Nodejs1 product
- undici< 5.28.4 | ≥ 6.0.0, < 6.11.1
Npm1 product
- undici< 5.28.4 | ≥ 6.0.0, < 6.11.1
Opensuse1 product
- nodejs-electron&distro=openSUSE Tumbleweed< 28.2.10-3.1
Ubuntu1 product
- node-undiciAll versions (No fix recorded)
6 vendors · 6 products
References
18 links- github.com/nodejs/undici/security/advisories/GHSA-9qxr-qj54-h672X Refsource CONFIRMREPORTWEBVendor Advisory
- github.com/nodejs/undici/commit/2b39440bd9ded841c93dd72138f3b1763ae26055X Refsource MISCREPORTWEBPatch
- github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3X Refsource MISCREPORTWEBPatch
Show all 18 references
- github.com/nodejs/undiciPACKAGE