CVE-2024-38372: Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a `fetch()` request, `response.arrayBuffer()`…

PriorityP49low2CVSS 3.1

AVNACHPRHUIRSUCLINAN

EPSS

0.47%

39.0th percentile

Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a `fetch()` request, `response.arrayBuffer()` might include portion of memory from the Node.js process. This has been patched in v6.19.2.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
debian	node-undici	—	—
nodejs	undici	—	—
nodejs	undici	>= 6.14.0 < 6.19.2	6.19.2

CVSS provenance

nvdv3.12.0LOWCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

osv2.0LOW

vendor_debian2.0LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.