Undici vulnerable to data leak when using response.arrayBuffer()

Description

Depending on network and process conditions of a fetch() request, response.arrayBuffer() might include portion of memory from the Node.js process.

Recommendation

Update the undici package to the latest compatible version. Followings are version details:

• Affected version(s): >= 6.14.0, < 6.19.2
• Patched version(s): 6.19.2

References

• GHSA-3g92-w8c5-73pq
• CVE-2024-38372
• CWE-201
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Svelte vulnerable to XSS when using objects during server-side rendering - CVE-2022-25875
• fetch(url) leads to a memory leak in undici - CVE-2024-24750
• tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled envir - CVE-2024-49364
• ajv has ReDoS when using `$data` option - CVE-2025-69873

Tags:

npm

undici