Vulnerability · Published Jul 8, 2024 · Assigned by GitHub_M
CVE-2024-38372Undici vulnerable to data leak when using response.arrayBuffer()
Low 2.0
In plain English
A low-severity security flaw in undici from nodejs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)2.0Low
Exploit odds (30 days)0.5%top 59.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a `fetch()` request, `response.arrayBuffer()` might include portion of memory from the Node.js process. This has been patched in v6.19.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:24.04:LTS | node-undici | no fix listed | UBUNTU-CVE-2024-38372 |
| Ubuntu:25.10 | node-undici | no fix listed | UBUNTU-CVE-2024-38372 |
| Ubuntu:26.04:LTS | node-undici | no fix listed | UBUNTU-CVE-2024-38372 |
| Ubuntu:26.10 | node-undici | no fix listed | UBUNTU-CVE-2024-38372 |
| npm | undici | 6.19.2 | GHSA-3g92-w8c5-73pq |
Affected products (as reported)
Weakness: CWE-201 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N
References
- https://github.com/nodejs/undici/security/advisories/GHSA-3g92-w8c5-73pq x_refsource_CONFIRM
- https://github.com/nodejs/undici/issues/3328 x_refsource_MISC
- https://github.com/nodejs/undici/issues/3337 x_refsource_MISC
- https://github.com/nodejs/undici/pull/3338 x_refsource_MISC
- https://github.com/nodejs/undici/commit/f979ec3204ca489abf30e7d20e9fee9ea7711d36 x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20240828-0009/