CVE-2024-38372

2024-07-0821:15:12

CWE-201

GitHub_M

web.nvd.nist.gov

undici

http/1.1

memory leak

node.js

patch

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

AI Score

Confidence

Low

EPSS

Percentile

15.8%

JSON

Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a fetch() request, response.arrayBuffer() might include portion of memory from the Node.js process. This has been patched in v6.19.2.

Affected configurations

Vulners

Vulnrichment

Node

nodejsundiciRange6.14.0–6.19.2

VendorProductVersionCPE
nodejsundici*cpe:2.3:a:nodejs:undici:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nodejs	undici	*	cpe:2.3:a:nodejs:undici::::::::

CNA Affected

[
  {
    "vendor": "nodejs",
    "product": "undici",
    "versions": [
      {
        "version": ">= 6.14.0, < 6.19.2",
        "status": "affected"
      }
    ]
  }
]