CVE-2024-30260 Undici's Proxy-Authorization header not cleared on cross

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Identified for Proxy-Authorization Header Vulnerabilities Two vulnerabilities have been identified related to the Proxy-Authorization header in the Undici library. CVE-2024-30260, published on April 4, 2024, and CVE-2024-28849, published on March 14, 2024, both allow for potential security issues due to improper handling of authorization headers across different hosts. Affected systems may be at risk if these vulnerabilities are not addressed. 3 sources 48