vulnerability
Amazon Linux 2023: CVE-2024-24758: Important priority package update for nodejs20 (Multiple Advisories)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 4 | (AV:N/AC:H/Au:M/C:P/I:P/A:P) | Feb 16, 2024 | Jul 4, 2025 | Jul 4, 2025 |
Severity
4
CVSS
(AV:N/AC:H/Au:M/C:P/I:P/A:P)
Published
Feb 16, 2024
Added
Jul 4, 2025
Modified
Jul 4, 2025
Description
Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
A sensitive information exposure vulnerability was found in undici. In this issue, it cleared Authorization headers on cross-origin redirects but did not clear the `Proxy-Authentication` headers.
A sensitive information exposure vulnerability was found in undici. In this issue, it cleared Authorization headers on cross-origin redirects but did not clear the `Proxy-Authentication` headers.
Solutions
amazon-linux-2023-upgrade-nodejsamazon-linux-2023-upgrade-nodejs20amazon-linux-2023-upgrade-nodejs20-debuginfoamazon-linux-2023-upgrade-nodejs20-debugsourceamazon-linux-2023-upgrade-nodejs20-develamazon-linux-2023-upgrade-nodejs20-docsamazon-linux-2023-upgrade-nodejs20-full-i18namazon-linux-2023-upgrade-nodejs20-libsamazon-linux-2023-upgrade-nodejs20-libs-debuginfoamazon-linux-2023-upgrade-nodejs20-npmamazon-linux-2023-upgrade-nodejs-debuginfoamazon-linux-2023-upgrade-nodejs-debugsourceamazon-linux-2023-upgrade-nodejs-develamazon-linux-2023-upgrade-nodejs-docsamazon-linux-2023-upgrade-nodejs-full-i18namazon-linux-2023-upgrade-nodejs-libsamazon-linux-2023-upgrade-nodejs-libs-debuginfoamazon-linux-2023-upgrade-nodejs-npmamazon-linux-2023-upgrade-v8-10-2-develamazon-linux-2023-upgrade-v8-11-3-devel
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.