CVE-2024-38372CWE-201

Undici vulnerable to data leak when using response.arrayBuffer()

Low · published July 8, 2024

CVSS v3.1
2.0
EPSS
0%
Percentile
39.5
In the wild
Unconfirmed
What it is

Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a `fetch()` request, `response.arrayBuffer()` might include portion of memory from the Node.js process. This has been patched in v6.19.2.

The record
Technical detail
CVSS v3.1
2.0 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00467 · 39.5th percentile
Weakness
CWE-201 · Insertion of Sensitive Information Into Sent Data
Published
2024-07-08T20:25Z
EPSS history
Timeline
  • 08 JUL 20:25Z
    Undici vulnerable to data leak when using response.arrayBuffer()
    cvelistv5