CVE-2024-24750 Backpressure request ignored in fetch() in Undici
Attackers can cause memory leaks and denial of service by sending requests where the response body is not consumed, affecting Node.js applications using Undici.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-24750?
CVE-2024-24750 is a medium-severity denial of service vulnerability in Nodejs Undici, published on 16 Feb 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling `fetch(url)` and not consuming the incoming body ((or consuming it very slowing) will lead to a memory leak. This issue has been addressed in version 6.6.1. Users are advised to upgrade. Users unable to upgrade should make sure to always consume the incoming body.
Which versions are affected by CVE-2024-24750?
2 open source packages ship an affected version, including undici. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
undici npm | From 6.0.0 | 6.6.1 |
undici npm | From 6.0.0 | 6.6.1 |
Products include Nodejs Undici.
How do I fix CVE-2024-24750?
Upgrade undici to 6.6.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-24750 being exploited?
There is no known exploitation of CVE-2024-24750 in the wild and no public exploit code.
Other vulnerabilities in Nodejs Undici
- CVE-2026-109855 undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake
- CVE-2026-109869 undici vulnerable to Denial of Service via unhandled error on excessive content-encodings
- CVE-2026-87018 undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation
- CVE-2026-19534 undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
- CVE-2026-12151 undici WebSocket client vulnerable to denial of service via fragment count bypass
Sources
Also known as GHSA-9f24-jqhm-jfcw, UBUNTU-CVE-2024-24750.