CVE-2024-38372
Undici vulnerable to data leak when using response.arrayBuffer()
Summary
Undici vulnerable to data leak when using response.arrayBuffer()
Original description
The description as published by the source.
Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a fetch() request, response.arrayBuffer() might include portion of memory from the Node.js process. This has been patched in v6.19.2.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Ubuntu UBUNTU-CVE-2024-38372 node-undici
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- patch github.com
- patch github.com
- report github.com
- report github.com