Medium severity · published Feb 16, 2024
CVE-2024-24750
Undici is an HTTP/1.1 client, written from scratch for Node.js
6.5
CVSS
0.7%
EPSS
No
On KEV
Description
Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling `fetch(url)` and not consuming the incoming body ((or consuming it very slowing) will lead to a memory leak. This issue has been addressed in version 6.6.1. Users are advised to upgrade. Users unable to upgrade should make sure to always consume the incoming body.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UN
Undici · Nodejs
6.0.0 before 6.6.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-24750
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-24750
Patch
https://github.com/nodejs/undici/commit/87a48113f1f68f60aa09abb07276d7c35467c663
Vendor Advisory
https://github.com/nodejs/undici/security/advisories/GHSA-9f24-jqhm-jfcw
Third Party Advisory
https://security.netapp.com/advisory/ntap-20240419-0006/
More from Undici
9.8
CVE-2026-1525
undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
9.8
CVE-2022-35949
undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the…
9.1
CVE-2026-109383
undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent
9.1
CVE-2026-109829
undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects
9.1
CVE-2026-84961
undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool