AZL-39819

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-39819.json

JSON Data

https://api.test.osv.dev/v1/vulns/AZL-39819

Upstream

CVE-2024-30261

Published

2024-04-04T15:15:39Z

Modified

2026-04-01T05:13:53.396333Z

Severity

3.5 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N CVSS Calculator

Summary

CVE-2024-30261 affecting package nodejs18 for versions less than 18.20.2-1

Details

Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the integrity option passed to fetch(), allowing fetch() to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-30261

Affected packages

Azure Linux:2 / nodejs18

Package

Name: nodejs18
Purl: pkg:rpm/azure-linux/nodejs18

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

18.20.2-1

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-39819.json"