Patched Memory Leak in Undici HTTP/1.1 Client
CVE-2024-38372

2LOW

Key Information:

Vendor

Nodejs

Status
Undici
Vendor
CVE Published:
8 July 2024

What is CVE-2024-38372?

Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a fetch() request, response.arrayBuffer() might include portion of memory from the Node.js process. This has been patched in v6.19.2.

Affected Version(s)

undici >= 6.14.0, < 6.19.2

References

https://github.com/nodejs/undici/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/nodejs/undici/issues/3328
x_refsource_MISC
https://github.com/nodejs/undici/issues/3337
x_refsource_MISC

CVSS V3.1

Score:
2
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.