Skip to content
Sign in
6.5 Medium

CVE-2024-24750 Undici is an HTTP/1.1 client, written from scratch for Node.js

Description

Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling `fetch(url)` and not consuming the incoming body ((or consuming it very slowing) will lead to a memory leak. This issue has been addressed in version 6.6.1. Users are advised to upgrade. Users unable to upgrade should make sure to always consume the incoming body.

Affected products and versions

Product Affected versions Fixed in
undici 6.0 6.0.0 → < 6.6.1 6.6.1

Other CVEs of undici

The 15 CVEs of undici →
CVE-2026-22036 Undici is an HTTP/1.1 client for Node.js 5.9 Medium CVE-2025-47279 Undici is an HTTP/1.1 client for Node.js 3.1 Low CVE-2025-22150 Undici is an HTTP/1.1 client 6.8 Medium CVE-2024-38372 Undici is an HTTP/1.1 client, written from scratch for Node.js 2.0 Low
Track this CVE