AZL-39773

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-39773.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-39773

Upstream

CVE-2024-30261

Published

2024-04-04T15:15:39Z

Modified

2026-04-21T04:28:49.221090Z

Severity

3.5 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N CVSS Calculator

Summary

CVE-2024-30261 affecting package nodejs for versions less than 20.14.0-1

Details

Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the integrity option passed to fetch(), allowing fetch() to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-30261

Affected packages

Azure Linux:3 / nodejs

Package

Name: nodejs
Purl: pkg:rpm/azure-linux/nodejs

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

20.14.0-1

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-39773.json"