p PatchFirst

CVE-2024-24750

CVE-2024-24750 · Backpressure request ignored in fetch() in Undici

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling `fetch(url)` and not consuming the incoming body ((or consuming it very slowing) will lead to a memory leak. This issue has been addressed in version 6.6.1. Users are advised to upgrade. Users unable to upgrade should make sure to always consume the incoming body.

CVSS 6.5 · Medium · EPSS 0.7% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • undici

    Versions
    • >= 6.0.0, < 6.6.1: Affected

    No fix published

  • undici npm

    Affected ranges
    • SEMVER: ≥ 6.0.0, < 6.6.1

    Update to 6.6.1

  • node-undici Ubuntu:24.04:LTS

    Versions
    • 5.22.1+dfsg1+~cs20.10.10.2-1ubuntu1
    • 5.26.3+dfsg1+~cs23.10.12-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-undici Ubuntu:25.10

    Versions
    • 7.3.0+dfsg1+~cs24.12.11-1
    • 7.3.0+dfsg1+~cs24.12.11-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-undici Ubuntu:26.10

    Versions
    • 7.18.2+dfsg+~cs3.2.0-1build1
    • 7.24.6+dfsg+~cs3.2.0-3
    • 8.5.0+dfsg+~cs3.2.0-2
    • 8.5.0+dfsg+~cs3.2.0-3
    • 8.9.0+dfsg+~cs3.2.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-undici Ubuntu:26.04:LTS

    Versions
    • 7.3.0+dfsg1+~cs24.12.11-2
    • 7.16.0+dfsg+~cs3.2.0-2
    • 7.18.2+dfsg+~cs3.2.0-1
    • 7.18.2+dfsg+~cs3.2.0-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →