CVE-2024-24750: Backpressure request ignored in fetch() in Undici
Impact
Calling fetch(url) and not consuming the incoming body ((or consuming it very slowing) will lead to a memory leak.
Patches
Patched in v6.6.1
Workarounds
Make sure to always consume the incoming body.
Other sources
Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling fetch(url) and not consuming the incoming body ((or consuming it very slowing) will lead to a memory leak. This issue has been addressed in version 6.6.1. Users are advised to upgrade. Users unable to upgrade should make sure to always consume the incoming body.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 6.6.1 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 6.6.1 - Configuration
When calling fetch(url), ensure the incoming response body is fully consumed (do not ignore it and do not consume it very slowly), to prevent the memory leak in affected versions.
Node.js Undici (fetch) Consume incoming response body = Always consume
Event History
Frequently Asked Questions
What is the severity of CVE-2024-24750?
CVE-2024-24750 is categorized as a medium severity vulnerability due to its potential to cause a memory leak.
How do I fix CVE-2024-24750?
To fix CVE-2024-24750, upgrade to the undici package version 6.6.1 or later.
What is the impact of CVE-2024-24750?
The impact of CVE-2024-24750 is a memory leak when calling fetch(url) without properly consuming the incoming body.
Which versions of undici are affected by CVE-2024-24750?
CVE-2024-24750 affects undici versions from 6.0.0 to 6.6.0.
What is the recommended workaround for CVE-2024-24750?
The recommended workaround for CVE-2024-24750 is to always consume the incoming body when using the fetch function.