{"metadata": {"vulnerability": "GHSA-M4V8-WQVR-P9F7", "count": 11, "kinds": {"milestone": 3, "sighting": 1, "kev": 0, "other": 7}}, "data": [{"timestamp": "2024-03-26T12:52:00.934Z", "date_only": false, "value": "2024-03-26T12:52:00.934Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5 \u00b7 CVE-2024-30260", "record": "CVE-2024-30260", "field": "cveMetadata.dateReserved"}, {"timestamp": "2024-04-04T14:20:39Z", "date_only": false, "value": "2024-04-04T14:20:39Z", "kind": "milestone", "label": "Published", "source": "github", "record": "GHSA-M4V8-WQVR-P9F7", "field": "published"}, {"timestamp": "2024-04-04T15:15:44.653Z", "date_only": false, "value": "2024-04-04T15:15:44.653Z", "kind": "milestone", "label": "Published", "source": "cvelistv5 \u00b7 CVE-2024-30260", "record": "CVE-2024-30260", "field": "cveMetadata.datePublished"}, {"timestamp": "2024-04-04T16:15:08Z", "date_only": false, "value": "2024-04-04T16:15:08Z", "kind": "other", "label": "Nvd published at", "source": "github", "record": "GHSA-M4V8-WQVR-P9F7", "field": "database_specific.nvd_published_at"}, {"timestamp": "2024-04-05T13:43:37.003Z", "date_only": false, "value": "2024-04-05T13:43:37.003793Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 \u00b7 CVE-2024-30260 / CISA-ADP", "record": "CVE-2024-30260", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2024-04-19T23:06:41.342Z", "date_only": false, "value": "2024-04-19T23:06:41.342Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2024-30260 / GitHub_M", "record": "CVE-2024-30260", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2024-06-04T17:38:49.201Z", "date_only": false, "value": "2024-06-04T17:38:49.201Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2024-30260 / CISA-ADP", "record": "CVE-2024-30260", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-02-13T19:18:22Z", "date_only": false, "value": "2025-02-13T19:18:22.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/4319", "record": "GHSA-M4V8-WQVR-P9F7", "field": "creation_timestamp", "uuid": "c37c4cce-72d5-4e4f-ba24-253169cb69f2", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-30260\n\ud83d\udd25 CVSS Score: 3.9 (CVSS_V3)\n\ud83d\udd39 Description: ### Impact\n\nUndici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`.\n\n### Patches\n\nThis has been patched in https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75.\nFixes has been released in v5.28.4 and v6.11.1.\n\n### Workarounds\n\nuse `fetch()` or disable `maxRedirections`.\n\n### References\n\nLinzi Shang reported this.\n\n* https://hackerone.com/reports/2408074\n* https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3\n\ud83d\udccf Published: 2024-04-04T14:20:39Z\n\ud83d\udccf Modified: 2025-02-13T19:02:14Z\n\ud83d\udd17 References:\n1. https://github.com/nodejs/undici/security/advisories/GHSA-m4v8-wqvr-p9f7\n2. https://nvd.nist.gov/vuln/detail/CVE-2024-30260\n3. https://github.com/nodejs/undici/commit/64e3402da4e032e68de46acb52800c9a06aaea3f\n4. https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75\n5. https://hackerone.com/reports/2408074\n6. https://github.com/nodejs/undici\n7. https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQVHWAS6WDXXIU7F72XI55VZ2LTZUB33\n8. https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NC3V3HFZ5MOJRZDY5ZELL6REIRSPFROJ\n9. https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P6Q4RGETHVYVHDIQGTJGU5AV6NJEI67E", "url": "https://t.me/DarkWebInformer_CVEAlerts/4319"}, {"timestamp": "2025-11-04T16:11:54.904Z", "date_only": false, "value": "2025-11-04T16:11:54.904Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2024-30260", "record": "CVE-2024-30260", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-11-04T16:11:54.904Z", "date_only": false, "value": "2025-11-04T16:11:54.904Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2024-30260 / CVE", "record": "CVE-2024-30260", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2025-11-04T19:44:28Z", "date_only": false, "value": "2025-11-04T19:44:28Z", "kind": "other", "label": "Updated", "source": "github", "record": "GHSA-M4V8-WQVR-P9F7", "field": "modified"}]}