Undici vulnerable to data leak when using response.arrayBuffer()

BASSO 2.0CVE-2024-38372 · GHSA-3g92-w8c5-73pq · Published 08/07/2024 · updated 17/06/2026

In breve

CVE-2024-38372 è una vulnerabilità BASSO (CVSS 2.0) che riguarda undici.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.47%, superiore al 40.4% delle vulnerabilità.
Correzione: aggiornare a 6.19.2 o successiva.

Package	Affected versions	Patched versions
undici npm	`≥ 6.14.0, < 6.19.2`	`6.19.2`

Description

Impact

Depending on network and process conditions of a fetch() request, response.arrayBuffer() might include portion of memory from the Node.js process.

Patches

This has been patched in v6.19.2.

Workarounds

There are no known workaround.

References

https://github.com/nodejs/undici/issues/3337 https://github.com/nodejs/undici/issues/3328 https://github.com/nodejs/undici/pull/3338 https://github.com/nodejs/undici/commit/f979ec3204ca489abf30e7d20e9fee9ea7711d36

NVD description

Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a `fetch()` request, `response.arrayBuffer()` might include portion of memory from the Node.js process. This has been patched in v6.19.2.

References

nodejs/undici security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-38372 · ADVISORY
nodejs/undici · WEB
nodejs/undici · WEB
nodejs/undici#3338 · WEB
nodejs/undici commit f979ec3 · WEB
nodejs/undici · PACKAGE
security.netapp.com/advisory/ntap-20240828-0009

Altre vulnerabilità di undici

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

undici

npm

≥ 6.14.0, < 6.19.2

6.19.2

Description

NVD description

Altre vulnerabilità di undici

Vedi tutto →