Undici vulnerable to data leak when using response.arrayBuffer()

Description

Depending on network and process conditions of a fetch() request, response.arrayBuffer() might include portion of memory from the Node.js process.

Recommendation

Update the undici package to the latest compatible version. Followings are version details:

• Affected version(s): >= 6.14.0, < 6.19.2
• Patched version(s): 6.19.2

References

• GHSA-3g92-w8c5-73pq
• CVE-2024-38372
• CWE-201
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled envir - CVE-2024-49364
• SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering - CVE-2025-67647
• `undici.request` vulnerable to SSRF using absolute URL on `pathname` - CVE-2022-35949
• Svelte vulnerable to XSS when using objects during server-side rendering - CVE-2022-25875

Tags:

npm

undici