fetch(url) leads to a memory leak in undici

Description

Calling fetch(url) and not consuming the incoming body ((or consuming it very slowing) will lead to a memory leak.

Recommendation

Update the undici package to the latest compatible version. Followings are version details:

• Affected version(s): >= 6.0.0, <= 6.6.0
• Patched version(s): 6.6.1

References

• GHSA-9f24-jqhm-jfcw
• security.netapp.com
• CVE-2024-24750
• CWE-400
• CWE-401
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Undici vulnerable to data leak when using response.arrayBuffer() - CVE-2024-38372
• Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resourc - CVE-2026-22036
• Undici proxy-authorization header not cleared on cross-origin redirect in fetch - CVE-2024-24758
• Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect - CVE-2024-30261

Tags:

npm

undici