CVE-2024-38372

Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a fetch request, response.arrayBuffer might include portion of memory from the Node.js process. This has been patched in v6.19.2...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that run Designer Flows containing event nodes are vulnerable to loss of confidentiality [CVE-2024-38372]

Summary Node.js undici module is used by IBM App Connect Enterprise Certified Container for HTTP calls. IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that run Designer flows that contain event nodes are vulnerable to loss of confidentiality. This...

Node.js Module Undici < 6.19.2 Information Disclosure

The nodejs module Undici detected on the host is prior to version 6.19.2. It is, therefore, affected by an information disclosure vulnerability. An authenticated, remote attacker can exploit this to obtain a portion of memory from the Node.js process. Note that Nessus has not tested for these...

@angular-devkit/build-angular (>=18.0.0-next.4, <=18.1.0-next.2), @angular/build (>=18.0.0-next.3, <=18.1.0-next.2) +64 more potentially affected by CVE-2024-38372 via undici (>=6.14.1, <=6.19.1)

undici NPM version =6.14.1, =18.0.0-next.4, =18.0.0-next.3, =1.2.0, =0.1.0, =2.1.0, =2.3.0, =1.1.1, =19.1.0, =10.0.20, =1.0.12, =2.1.1-dev.1717589072-346d1be72, =2.4.0-dev.1717589083-346d1be72, =2.4.0-dev.1724328261-ec9080b88 - @draftbot/discord.js 14.15.3 - @draftbot/rest 2.3.0 and more Source...