Undici vulnerable to data leak when using response.arrayBuffer()

Description

Depending on network and process conditions of a fetch() request, response.arrayBuffer() might include portion of memory from the Node.js process.

Recommendation

Update the undici package to the latest compatible version. Followings are version details:

• Affected version(s): >= 6.14.0, < 6.19.2
• Patched version(s): 6.19.2

References

• GHSA-3g92-w8c5-73pq
• CVE-2024-38372
• CWE-201
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering - @sveltejs/adapter-node - CVE-2025-67647
• Svelte vulnerable to XSS when using objects during server-side rendering - CVE-2022-25875
• SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering - CVE-2025-67647
• tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled envir - CVE-2024-49364

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

undici