Description
Depending on network and process conditions of a fetch() request, response.arrayBuffer() might include portion of memory from the Node.js process.
Recommendation
Update the undici package to the latest compatible version. Followings are version details:
- Affected version(s): >= 6.14.0, < 6.19.2
- Patched version(s): 6.19.2
References
Related Issues
- Svelte vulnerable to XSS when using objects during server-side rendering - CVE-2022-25875
- SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering - CVE-2025-67647
- SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering - @sveltejs/adapter-node - CVE-2025-67647
- Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect - CVE-2024-30261
You might also like:
- Tags:
- npm
- undici
Anything's wrong? Let us know Last updated on August 08, 2024