Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-24750

Good to know:

icon
icon

Date: February 16, 2024

Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling "fetch(url)" and not consuming the incoming body ((or consuming it very slowing) will lead to a memory leak. This issue has been addressed in version 6.6.1. Users are advised to upgrade. Users unable to upgrade should make sure to always consume the incoming body.

Language: JS

Severity Score

Related Resources (8)

https://github.com/nodejs/undici
https://security.netapp.com/advisory/ntap-20240419-0006
https://github.com/nodejs/undici/releases/tag/v6.6.1
https://github.com/nodejs/undici/commit/87a48113f1f68f60aa09abb07276d7c35467c663
https://nvd.nist.gov/vuln/detail/CVE-2024-24750
https://security.netapp.com/advisory/ntap-20240419-0006/
https://github.com/nodejs/undici/security/advisories/GHSA-9f24-jqhm-jfcw
https://www.mend.io/vulnerability-database/CVE-2024-24750

Severity Score

Weakness Type (CWE)

Uncontrolled Resource Consumption

CWE-400

Missing Release of Memory after Effective Lifetime

CWE-401

Top Fix

icon

Upgrade Version

Upgrade to version undici - 6.6.1

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): HIGH

Do you need more information?

Contact Us