Description
Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a `fetch()` request, `response.arrayBuffer()` might include portion of memory from the Node.js process. This has been patched in v6.19.2.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
nodejs undici
>= 6.14.0, < 6.19.2affected
References
- https://github.com/nodejs/undici/security/advisories/GHSA-3g92-w8c5-73pq ↗
- https://github.com/nodejs/undici/issues/3328 ↗
- https://github.com/nodejs/undici/issues/3337 ↗
- https://github.com/nodejs/undici/pull/3338 ↗
- https://github.com/nodejs/undici/commit/f979ec3204ca489abf30e7d20e9fee9ea7711d36 ↗
- https://security.netapp.com/advisory/ntap-20240828-0009/ ↗