CVE-2024-38372

Published: Jul 8, 2024Modified: Jun 17, 2026Deferred

2.0

Vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

Exploitability: 0.5 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a `fetch()` request, `response.arrayBuffer()` might include portion of memory from the Node.js process. This has been patched in v6.19.2.

Related CWEs

CWE-201

Insertion of Sensitive Information Into Sent Data

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

References (11)

https://github.com/nodejs/undici/commit/f979ec3204ca489abf30e7d20e9fee9ea7711d36

Source: security-advisories@github.com

https://github.com/nodejs/undici/issues/3328

Source: security-advisories@github.com

https://github.com/nodejs/undici/issues/3337

Source: security-advisories@github.com

https://github.com/nodejs/undici/pull/3338

Source: security-advisories@github.com

https://github.com/nodejs/undici/security/advisories/GHSA-3g92-w8c5-73pq

Source: security-advisories@github.com

https://github.com/nodejs/undici/commit/f979ec3204ca489abf30e7d20e9fee9ea7711d36