CVE-2024-24758

Summary

CVE-2024-24758 is a vulnerability affecting Undici, an HTTP/1.1 client for Node.js. The issue lies in Undici's failure to clear `Proxy-Authentication` headers during cross-origin redirects, despite already removing Authorization headers under similar circumstances. This oversight could result in unintended authentication data being exposed. Users are strongly encouraged to upgrade to Undici versions 5.28.3 or 6.6.1 to mitigate this risk, as there are currently no known workarounds for this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.