CVE-2024-38372

low

Description

Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a `fetch()` request, `response.arrayBuffer()` might include portion of memory from the Node.js process. This has been patched in v6.19.2.

References

https://github.com/nodejs/undici/security/advisories/GHSA-3g92-w8c5-73pq

https://github.com/nodejs/undici/pull/3338

https://github.com/nodejs/undici/issues/3337

https://github.com/nodejs/undici/issues/3328

https://github.com/nodejs/undici/commit/f979ec3204ca489abf30e7d20e9fee9ea7711d36

Details

Source: Mitre, NVD

Published: 2024-07-08

Updated: 2024-07-09

Risk Information

CVSS v2

Base Score: 1.7

Vector: CVSS2#AV:N/AC:H/Au:M/C:P/I:N/A:N

Severity: Low

CVSS v3

Base Score: 2

Vector: CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N