CVE-2024-24758

Overview

Node.js is an asynchronous, event-driven JavaScript runtime designed for building scalable network applications. Node.js's global fetch() is not written in Node.js core itself: it is provided by undici, an HTTP/1.1 client maintained by the Node.js project, which Node.js bundles at deps/undici and ships inside the runtime. A vulnerability in the bundled undici therefore affects fetch() in Node.js directly, even for applications that never install the undici package from npm.

An information exposure vulnerability (CVE-2024-24758) has been identified in the undici library bundled with Node.js. When fetch() follows a redirect to a different origin, it is supposed to strip credentials meant only for the original destination. Undici already removed the Authorization header in that case. However, it did not remove the Proxy-Authorization header, so proxy credentials set by the application could be forwarded to whatever origin the redirect pointed at.

This behaviour maps to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), where a product exposes sensitive information to an actor that is not explicitly authorized to have it. In undici, the credential is the Proxy-Authorization header, and the unauthorized actor is the redirect target. Leaked proxy credentials can let a third party use, or impersonate the application on, the proxy they unlock.

Exploitation requires an application that sets a Proxy-Authorization header on a fetch() request and lets fetch() follow redirects, the default. It also requires an attacker who controls, or can make the original server issue, a redirect to an origin of the attacker's choosing. Applications that never send Proxy-Authorization through fetch(), or that set redirect: 'manual' or 'error', are not exposed. In Node.js 16.x (from 16.15.0) and 17.x (from 17.5.0), fetch() is only available behind the --experimental-fetch flag; from 18.0.0 it is enabled by default. This issue affects those lines, 19.x, and 18.x, 20.x and 21.x before the versions listed above.

Details

Module Info

• Product: Node.js
• Affected packages: node (bundles undici under deps/undici); the standalone undici npm package before 5.28.3, and from 6.0.0 before 6.6.1, is affected in its own right
• Affected versions: >=16.15.0 <=16.20.2 >=17.5.0 <=17.9.1 >=18.0.0 <18.19.1 >=19.0.0 <=19.9.0 >=20.0.0 <20.11.1 >=21.0.0 <21.6.2
• GitHub repository: https://github.com/nodejs/node
• Published packages: https://nodejs.org/en/download
• Package manager: Not applicable; Node.js is distributed as runtime builds from nodejs.org rather than as a published npm package
• Fixed in: Node.js 18.19.1, 20.11.1, and 21.6.2 (upstream fixes, released February 14, 2024 with undici 5.28.3, while those lines were still supported); Node.js NES v16.20.5 (16.x line, shipped January 16, 2025), which never received an upstream fix before reaching End-of-Life

Vulnerability Info

This Medium-severity vulnerability is found in the redirect handling of fetch() in the undici library that Node.js bundles at deps/undici, in every Node.js release that bundles undici before 5.28.3. NVD assigns a CVSS v3.1 score of 4.5; the GitHub advisory rates it Low at 3.9.

When fetch() follows a redirect, undici's HTTP-redirect step checks whether the new location has the same origin as the current request. On a cross-origin redirect, it should drop every header that carries credentials for the original destination. In the vulnerable implementation, it deleted Authorization, Cookie and Host but left Proxy-Authorization in place, and resent it to the new origin. The fix adds Proxy-Authorization to the headers removed on cross-origin redirects. See the undici fix commit for the exact change.

An attacker would need the application to send proxy credentials with a fetch() request to a server that returns, or can be induced to return, a redirect to an attacker-controlled origin.

Note: Because the header is only leaked when the application sets Proxy-Authorization on the request itself, applications that configure proxy credentials elsewhere or never use proxies with fetch() are not exposed by this issue.

Mitigation

The Node.js 16.x, 17.x, 18.x, 19.x, 20.x and 21.x release lines are all past their support window and will not receive further upstream updates. Node.js 16.x reached End-of-Life on September 11, 2023; Node.js 17.x on June 1, 2022; Node.js 18.x on April 30, 2025; Node.js 19.x on June 1, 2023; Node.js 20.x on April 30, 2026; and Node.js 21.x on June 1, 2024. For more information see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported Node.js LTS release (22.x or 24.x), both of which bundle an undici version that already includes this fix.
• Migrate affected applications away from the End-of-Life Node.js release lines.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, through Node.js NES.

Credits

• T1m0n0 (reporter)
• Matteo Collina (coordinator)