Vulnerability · Published Feb 16, 2024 · Assigned by GitHub_M
CVE-2024-24750Backpressure request ignored in fetch() in Undici
Medium 6.5
In plain English
A medium-severity uncontrolled resource consumption in undici from nodejs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling `fetch(url)` and not consuming the incoming body ((or consuming it very slowing) will lead to a memory leak. This issue has been addressed in version 6.6.1. Users are advised to upgrade. Users unable to upgrade should make sure to always consume the incoming body.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:24.04:LTS | node-undici | no fix listed | UBUNTU-CVE-2024-24750 |
| Ubuntu:25.10 | node-undici | no fix listed | UBUNTU-CVE-2024-24750 |
| Ubuntu:26.04:LTS | node-undici | no fix listed | UBUNTU-CVE-2024-24750 |
| Ubuntu:26.10 | node-undici | no fix listed | UBUNTU-CVE-2024-24750 |
| npm | undici | 6.6.1 | GHSA-9f24-jqhm-jfcw |
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H