CVE-2024-24750
published 2024-02-16CVE-2024-24750: Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling `fetch(url)` and not consuming the incoming body ((or consuming it…
PriorityP429medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.70%
50.8th percentile
Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling `fetch(url)` and not consuming the incoming body ((or consuming it very slowing) will lead to a memory leak. This issue has been addressed in version 6.6.1. Users are advised to upgrade. Users unable to upgrade should make sure to always consume the incoming body.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | node-undici | — | — |
| nodejs | undici | — | — |
| nodejs | undici | >= 6.0.0 < 6.6.1 | 6.6.1 |
| nodejs | undici | >= 6.0.0 < 6.6.1 | 6.6.1 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
osv6.5MEDIUM
vendor_debian6.5LOW
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
undici: memory leak
vendor_redhat·2024-02-16·CVSS 6.5
CVE-2024-24750 [MEDIUM] CWE-400 undici: memory leak
undici: memory leak
Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling `fetch(url)` and not consuming the incoming body ((or consuming it very slowing) will lead to a memory leak. This issue has been addressed in version 6.6.1. Users are advised to upgrade. Users unable to upgrade should make sure to always consume the incoming body.
An uncontrolled resource consumption flaw was found in undici. Calling `fetch(url)` and not consuming the incoming body or consuming it very slowly leads to a memory leak.
Statement: Users unable to upgrade should make sure to always consume the incoming body.
Package: undici (Red Hat build of Apache Camel - HawtIO 4) - Not affected
Package: rhdh/rhdh-hub-rhel9 (Red Hat Developer Hub) - Not affected
Package: node
Debian
CVE-2024-24750: node-undici - Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected vers...
vendor_debian·2024·CVSS 6.5
CVE-2024-24750 [MEDIUM] CVE-2024-24750: node-undici - Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected vers...
Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling `fetch(url)` and not consuming the incoming body ((or consuming it very slowing) will lead to a memory leak. This issue has been addressed in version 6.6.1. Users are advised to upgrade. Users unable to upgrade should make sure to always consume the incoming body.
Scope: local
bookworm: resolved
forky: resolved
sid: resolved
trixie: resolved
OSV
fetch(url) leads to a memory leak in undici
osv·2024-02-16
CVE-2024-24750 [MEDIUM] fetch(url) leads to a memory leak in undici
fetch(url) leads to a memory leak in undici
### Impact
Calling `fetch(url)` and not consuming the incoming body ((or consuming it very slowing) will lead to a memory leak.
### Patches
Patched in v6.6.1
### Workarounds
Make sure to always consume the incoming body.
OSV
CVE-2024-24750: Undici is an HTTP/1
osv·2024-02-16·CVSS 6.5
CVE-2024-24750 [MEDIUM] CVE-2024-24750: Undici is an HTTP/1
Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling `fetch(url)` and not consuming the incoming body ((or consuming it very slowing) will lead to a memory leak. This issue has been addressed in version 6.6.1. Users are advised to upgrade. Users unable to upgrade should make sure to always consume the incoming body.
GHSA
fetch(url) leads to a memory leak in undici
ghsa·2024-02-16
CVE-2024-24750 [MEDIUM] CWE-400 fetch(url) leads to a memory leak in undici
fetch(url) leads to a memory leak in undici
### Impact
Calling `fetch(url)` and not consuming the incoming body ((or consuming it very slowing) will lead to a memory leak.
### Patches
Patched in v6.6.1
### Workarounds
Make sure to always consume the incoming body.
No detection rules found.
No public exploits indexed.
https://github.com/nodejs/undici/commit/87a48113f1f68f60aa09abb07276d7c35467c663https://github.com/nodejs/undici/security/advisories/GHSA-9f24-jqhm-jfcwhttps://security.netapp.com/advisory/ntap-20240419-0006/https://github.com/nodejs/undici/commit/87a48113f1f68f60aa09abb07276d7c35467c663https://github.com/nodejs/undici/security/advisories/GHSA-9f24-jqhm-jfcwhttps://security.netapp.com/advisory/ntap-20240419-0006/
2024-02-16
Published