Undici vulnerable to data leak when using response.arrayBuffer()
GHSA-3g92-w8c5-73pq · CVE-2024-38372
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Impact
Depending on network and process conditions of a fetch() request, response.arrayBuffer() might include portion of memory from the Node.js process.
Patches
This has been patched in v6.19.2.
Workarounds
There are no known workaround.
References
https://github.com/nodejs/undici/issues/3337
https://github.com/nodejs/undici/issues/3328
https://github.com/nodejs/undici/pull/3338
https://github.com/nodejs/undici/commit/f979ec3204ca489abf30e7d20e9fee9ea7711d36
References
- WEB https://github.com/nodejs/undici/security/advisories/GHSA-3g92-w8c5-73pq
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2024-38372
- WEB https://github.com/nodejs/undici/issues/3328
- WEB https://github.com/nodejs/undici/issues/3337
- WEB https://github.com/nodejs/undici/pull/3338
- WEB https://github.com/nodejs/undici/commit/f979ec3204ca489abf30e7d20e9fee9ea7711d36
- PACKAGE https://github.com/nodejs/undici
Ready to move
Start Securing
Free, no credit card | First findings in minutes