CVE-2024-24758: 
JavaScript vulnerability analysis and mitigation

A low severity vulnerability (CVE-2024-24758) was identified in Undici, an HTTP/1.1 client for Node.js. The vulnerability affects Undici versions 5.28.2 and prior, as well as versions 6.0.0 through 6.6.0. While Undici already cleared Authorization headers on cross-origin redirects, it did not clear Proxy-Authentication headers, potentially leading to information disclosure (NodeJS Blog, GitHub Advisory).

The vulnerability stems from an incomplete implementation of security headers clearing during cross-origin redirects. While the system was correctly handling Authorization headers, it failed to clear Proxy-Authorization headers in cross-origin redirect scenarios. The vulnerability has been assigned a CVSS score of 3.9 (Low) with the vector CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L (GitHub Advisory).

The successful exploitation of this vulnerability could lead to the disclosure of sensitive information, addition or modification of data, or potential Denial of Service (DoS) in applications using affected versions of Undici (NetApp Security).

The vulnerability has been patched in Undici versions 5.28.3 and 6.6.1. Users are advised to upgrade to these patched versions as there are no known workarounds (GitHub Advisory).