| Package | Affected versions | Patched versions |
|---|---|---|
| undici | ≥ 6.14.0, < 6.19.2 | 6.19.2 |
Depending on network and process conditions of a fetch() request, response.arrayBuffer() might include portion of memory from the Node.js process.
This has been patched in v6.19.2.
There are no known workaround.
https://github.com/nodejs/undici/issues/3337 https://github.com/nodejs/undici/issues/3328 https://github.com/nodejs/undici/pull/3338 https://github.com/nodejs/undici/commit/f979ec3204ca489abf30e7d20e9fee9ea7711d36
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free