CVE-2024-38372 Undici vulnerable to data leak when using response.arrayBuffer()
Undici HTTP client may leak process memory via response.arrayBuffer(), allowing attackers to read sensitive data.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-38372?
CVE-2024-38372 is a low-severity vulnerability in nodejs undici, published on 8 Jul 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a `fetch()` request, `response.arrayBuffer()` might include portion of memory from the Node.js process. This has been patched in v6.19.2.
Weakness: CWE-201
Which versions are affected by CVE-2024-38372?
2 open source packages ship an affected version, including undici.
| Package | Affected | Fixed in |
|---|---|---|
undici npm | From 6.14.0 | 6.19.2 |
undici npm | From 6.14.0 | 6.19.2 |
How do I fix CVE-2024-38372?
Upgrade undici to 6.19.2 or later.
Is CVE-2024-38372 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-38372 exists.
Sources
Also known as GHSA-3g92-w8c5-73pq, ROOT-APP-NPM-CVE-2024-38372, UBUNTU-CVE-2024-38372.