VULNERABILITY INTELLIGENCE

CVE-2024-24750

CVSS score6.5 MEDIUM

EPSS probability0.70%

CISA KEVNot currently listed

Published2024-02-16

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Description

Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling `fetch(url)` and not consuming the incoming body ((or consuming it very slowing) will lead to a memory leak. This issue has been addressed in version 6.6.1. Users are advised to upgrade. Users unable to upgrade should make sure to always consume the incoming body.

Weakness classification

CWE-400: Uncontrolled Resource Consumption
CWE-401: Missing Release of Memory after Effective Lifetime

Primary references

security-advisories@github.com — Patch
security-advisories@github.com — Vendor Advisory
security-advisories@github.com — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory