LowGHSA-3g92-w8c5-73pqCVE-2024-38372

Undici vulnerable to data leak when using response.arrayBuffer()

Published 9 Jul 2024 · Updated 10 Sept 2026

Affected package

Affected: >=6.14.0 <6.19.2
Fixed in: 6.19.2

Update to the fixed version for your release line, for example:npm install undici@6.19.2

Details

Impact

Depending on network and process conditions of a fetch() request, response.arrayBuffer() might include portion of memory from the Node.js process.

Patches

This has been patched in v6.19.2.

Workarounds

There are no known workaround.

References

https://github.com/nodejs/undici/issues/3337 https://github.com/nodejs/undici/issues/3328 https://github.com/nodejs/undici/pull/3338 https://github.com/nodejs/undici/commit/f979ec3204ca489abf30e7d20e9fee9ea7711d36

Is GHSA-3g92-w8c5-73pq in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected undici, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.