Skip to main content

Missing Release of Memory after Effective Lifetime

CVE-2024-24750

Medium
6.5/10

Summary

Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling `fetch(url)` and not consuming the incoming body(or consuming it very slowly) will lead to a memory leak. This vulnerability affects undici package versions 6.0.0 through 6.6.0. Users are advised to upgrade. Users unable to upgrade should make sure to always consume the incoming body.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • REQUIRED
  • NONE
  • NONE
  • HIGH

CWE-401 - Missing release of memory after effective lifetime (memory leak)

'Missing release of memory after effective lifetime (memory leak)' is a weakness that occurs when software doesn't effectively release allocated memory after it is used. If not addressed, this enables attackers to launch denial of service attacks (by crashing or hanging the program) or take advantage of other unexpected behavior resulting from low memory conditions.

References

Advisory Timeline

  • Published