Executive brief
undici is a Node.js HTTP client library used by fetch() implementations. When an application calls fetch() but fails to consume (or slowly consumes) the response body, undici leaks memory that accumulates over time. A user interaction (such as a request being initiated) is required, making this a moderate denial-of-service risk in applications that make many network requests without properly handling responses.
Technical details
This vulnerability is a resource exhaustion issue (CWE-400, CWE-401) in undici versions 6.0.0 through 6.6.0 where the backpressure mechanism in the fetch() function is ignored. When a caller does not consume or slowly consumes the incoming response body, memory is not properly released, leading to a memory leak. The attack requires network reachability and user interaction to trigger the fetch() call. An attacker can exploit this by causing an application to make repeated fetch() requests with unconsumed responses, eventually exhausting available memory and causing availability disruption. The vulnerability was patched in version 6.6.1.
Affected products
- Node.js undici 6.0.0 through 6.6.0
Timeline
- 2024-02-16: disclosed
- 2024-02-16: patched: version 6.6.1
- 2024-02-16: advisory