fetch(url) leads to a memory leak in undici

Description

Calling fetch(url) and not consuming the incoming body ((or consuming it very slowing) will lead to a memory leak.

Recommendation

Update the undici package to the latest compatible version. Followings are version details:

• Affected version(s): >= 6.0.0, <= 6.6.0
• Patched version(s): 6.6.1

References

• GHSA-9f24-jqhm-jfcw
• security.netapp.com
• CVE-2024-24750
• CWE-400
• CWE-401
• CAPEC-310
• OWASP 2021-A6

Related Issues

• mpregular vulnerable to prototype pollution - CVE-2025-57323
• DOMPurify allows Cross-site Scripting (XSS) - CVE-2025-26791
• undici Denial of Service attack via bad certificate data - CVE-2025-47279
• lite-server vulnerable to Denial of Service - CVE-2022-25940

Tags:

npm

undici