Junglewise Threat Intelligence

CVE-2024-38372: Node.js Undici information leak in response.arrayBuffer

CVE-2024-38372 · Severity: low · CVSS 3.1 · Published 2024-07-09

Technologies: undici (npm). Vendors: npm.

Executive brief

Undici, a popular HTTP client for Node.js, contains a vulnerability that can cause it to accidentally include private server memory in web responses. This means that when an application processes a network request, it might inadvertently leak sensitive internal data—such as snippets of other users' data or system information—to the recipient. This could lead to minor data exposure or cause application errors when the leaked data interferes with expected data formats like JSON.

Technical details

A vulnerability in Undici's fetch implementation (specifically within the response.arrayBuffer() method) can lead to an information leak (CWE-201). Under certain network and process conditions, the buffer returned by the client may contain uninitialized or residual data from the Node.js process memory instead of just the intended response body. This issue was introduced in version 6.14.0 due to performance optimizations in body mixin methods. An attacker would typically need to be in a position to receive or intercept these responses to observe the leaked memory. The vulnerability has been resolved in version 6.19.2 by ensuring proper buffer handling.

Affected products

  • Node.js undici >= 6.14.0, < 6.19.2

Timeline

  • 2024-06-14: other: Initial bug report of JSON parsing failures in Node 22
  • 2024-07-08: advisory: GitHub Security Advisory published
  • 2024-07-08: patched: Fix released in version 6.19.2

References

Related threats