Lookup for vulnerable packages by Package URL.
| Purl | pkg:npm/undici@6.11.1 |
|---|
| Type | npm |
|---|
| Namespace | |
|---|
| Name | undici |
|---|
| Version | 6.11.1 |
|---|
| Qualifiers |
|
|---|
| Subpath | |
|---|
| Is_vulnerable | false |
|---|
| Next_non_vulnerable_version | 6.23.0 |
|---|
| Latest_non_vulnerable_version | 7.18.2 |
|---|
| Affected_by_vulnerabilities |
|
|---|
| Fixing_vulnerabilities |
| 0 |
| url |
VCID-7axr-j2xk-cugt |
| vulnerability_id |
VCID-7axr-j2xk-cugt |
| summary |
Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect
If an attacker can alter the `integrity` option passed to `fetch()`, they can let `fetch()` accept requests as valid even if they have been tampered. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2024-30261, GHSA-9qxr-qj54-h672
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-7axr-j2xk-cugt |
|
| 1 |
| url |
VCID-kqg3-sar6-b7em |
| vulnerability_id |
VCID-kqg3-sar6-b7em |
| summary |
Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline
Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2024-30260, GHSA-m4v8-wqvr-p9f7
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-kqg3-sar6-b7em |
|
|
|---|
| Risk_score | null |
|---|
| Resource_url | http://public2.vulnerablecode.io/packages/pkg:npm/undici@6.11.1 |
|---|