Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a `fetch()` request, `response.arrayBuffer()` might include portion of memory from the Node.js process. This has been patched in v6.19.2.
https://github.com/nodejs/undici/security/advisories/GHSA-3g92-w8c5-73pq
https://github.com/nodejs/undici/pull/3338
https://github.com/nodejs/undici/issues/3337
https://github.com/nodejs/undici/issues/3328
https://github.com/nodejs/undici/commit/f979ec3204ca489abf30e7d20e9fee9ea7711d36
Published: 2024-07-08
Updated: 2024-07-09
Base Score: 1.7
Vector: CVSS2#AV:N/AC:H/Au:M/C:P/I:N/A:N
Severity: Low
Base Score: 2
Vector: CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N
Severity: Low
Base Score: 2
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Severity: Low
EPSS: 0.003