CVE-2024-30261: 
JavaScript vulnerability analysis and mitigation

Undici, an HTTP/1.1 client written for Node.js, was found to contain a security vulnerability identified as CVE-2024-30261. The vulnerability was discovered and disclosed on April 4, 2024, affecting versions prior to 5.28.4 and versions 6.0.0 through 6.11.0. This vulnerability allows an attacker to alter the integrity option passed to fetch(), enabling the acceptance of tampered requests as valid (GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 3.5 (Low) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N. The issue specifically relates to the validation of the integrity option in the fetch() function, where the implementation was too lax when validating hash values even when the algorithm was correctly specified (NVD).

When exploited, this vulnerability allows attackers to bypass integrity checks on fetched resources. This means that even if a request has been tampered with, it could still be accepted as valid, potentially leading to the execution of modified or malicious content (GitHub Advisory).

The vulnerability requires network access and low privileges, though user interaction is required for exploitation. The attack complexity is considered low, making it relatively straightforward to exploit if an attacker can manipulate the integrity option (NVD).

The vulnerability has been patched in versions 5.28.4 and 6.11.1. Users are advised to upgrade to these versions or later. For those unable to upgrade immediately, the recommended workaround is to ensure that the integrity option cannot be tampered with (GitHub Advisory).