CVE-2024-24750: Backpressure request ignored in fetch() in Undici

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-16 · updated 2026-06-17
Weakness: CWE-400

Description

Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling `fetch(url)` and not consuming the incoming body ((or consuming it very slowing) will lead to a memory leak. This issue has been addressed in version 6.6.1. Users are advised to upgrade. Users unable to upgrade should make sure to always consume the incoming body.

Affected products

undici: from 6.0.0 before 6.6.1 — fixed in 6.6.1

How to fix

Upgrade to a fixed version: undici 6.6.1. Check the vendor advisory for mitigations.

References

https://github.com/nodejs/undici/commit/87a48113f1f68f60aa09abb07276d7c35467c663
https://github.com/nodejs/undici/security/advisories/GHSA-9f24-jqhm-jfcw
https://security.netapp.com/advisory/ntap-20240419-0006/
https://github.com/nodejs/undici/commit/87a48113f1f68f60aa09abb07276d7c35467c663
https://github.com/nodejs/undici/security/advisories/GHSA-9f24-jqhm-jfcw
https://security.netapp.com/advisory/ntap-20240419-0006/

Get alerted when CVE-2024-24750 or the next vulnerability affects your stack