CVE-2024-24750
MEDIUMUndici <6.6.1 - Memory Corruption
Title source: llmDescription
Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling `fetch(url)` and not consuming the incoming body ((or consuming it very slowing) will lead to a memory leak. This issue has been addressed in version 6.6.1. Users are advised to upgrade. Users unable to upgrade should make sure to always consume the incoming body.
Scores
CVSS v3
6.5
EPSS
0.0032
EPSS Percentile
54.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Classification
CWE
CWE-401
CWE-400
Status
published
Affected Products (2)
nodejs/undici
< 6.6.1
npm/undici
< 6.6.1npm
Timeline
Published
Feb 16, 2024
Tracked Since
Feb 18, 2026