CVE-2024-38372

What it actually does

Under specific network and process conditions during a fetch() request, response.arrayBuffer() can return a buffer containing portions of unrelated memory from the Node.js process heap.

Why it matters to the business

Low-risk potential exposure of sensitive in-memory data such as credentials or internal application state in Node.js applications using the undici HTTP client; limited operational impact due to narrow triggering conditions and low exploitability.

How an attack unfolds

An attacker sends a fetch request to a target using undici and, under favorable timing or network conditions, inspects the result of response.arrayBuffer() to extract leaked process memory fragments containing sensitive data.

How to fix it

Upgrade undici to version 6.19.2 or later (commit 532b7b28827afe52ed7b43cbb210ac8425516c28) in all affected Node.js projects and rebuild or redeploy dependent applications.

How to confirm the fix worked

Verify undici version is 6.19.2 or newer via package.json or npm list, then test fetch responses under varied network conditions to confirm arrayBuffer() no longer contains extraneous memory data.

Typical attack path

1. Identify a Node.js application using vulnerable undici for outbound fetch requests
2. Trigger a fetch() call under specific network or process timing conditions
3. Call response.arrayBuffer() on the returned response object
4. Inspect the resulting buffer for unintended memory contents from the Node.js heap

How to detect it

Review application logs and memory dumps for unexpected buffer contents after fetch operations; no specific post-exploitation artifacts are known, so focus on confirming the presence of vulnerable undici versions in running processes or containers.

What your security team should do

• Immediately upgrade all undici dependencies to 6.19.2 or later across the Node.js ecosystem
• Scan package locks and CI pipelines for older undici versions and enforce minimum version in dependency policies
• Monitor for any future undici updates given its widespread use in Node.js HTTP clients