fetch(url) leads to a memory leak in undici

Description

Calling fetch(url) and not consuming the incoming body ((or consuming it very slowing) will lead to a memory leak.

Recommendation

Update the undici package to the latest compatible version. Followings are version details:

• Affected version(s): >= 6.0.0, <= 6.6.0
• Patched version(s): 6.6.1

References

• GHSA-9f24-jqhm-jfcw
• security.netapp.com
• CVE-2024-24750
• CWE-400
• CWE-401
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect - CVE-2024-30261
• ReDoS Vulnerability in ua-parser-js version - CVE-2022-25927
• mpregular vulnerable to prototype pollution - CVE-2025-57323
• node-cube vulnerable to prototype pollution - CVE-2025-57348

Tags:

npm

undici