CVE-2024-24750: Node.js Undici Memory Leak DOS Vulnerability

CVE-2024-24750 Overview

CVE-2024-24750 is a memory leak vulnerability in Undici, an HTTP/1.1 client written from scratch for Node.js. The flaw affects Node.js applications that call fetch(url) and either do not consume the response body or consume it too slowly. Under these conditions, memory allocated for incoming response streams is not released, allowing sustained resource exhaustion. The issue is tracked as CWE-400 (Uncontrolled Resource Consumption) and CWE-401 (Missing Release of Memory after Effective Lifetime). Version 6.6.1 of Undici addresses the defect. The advisory is published as GHSA-9f24-jqhm-jfcw.

Critical Impact
Remote attackers can trigger sustained memory growth in vulnerable Node.js services, leading to denial of service through process exhaustion.

Affected Products

Node.js Undici versions prior to 6.6.1
Applications embedding Undici as an HTTP/1.1 client
NetApp products bundling Undici (see NetApp Security Advisory ntap-20240419-0006)

Discovery Timeline

2024-02-16 - CVE-2024-24750 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-24750

Vulnerability Analysis

Undici implements the WHATWG Fetch specification for Node.js. When application code invokes fetch(url), Undici constructs a ReadableStream backed by the network transport. The vulnerable implementation used the start callback of the ReadableStream constructor to eagerly pull data from the underlying reader in an unbounded loop. The stream continued to buffer incoming bytes regardless of whether the consumer had backpressure signals or was reading at all.

If the calling code discarded the Response object without draining response.body, buffered chunks accumulated in memory. Attackers who could induce a target service to fetch attacker-controlled or large third-party URLs could amplify this behavior by returning oversized response bodies. Sustained requests exhaust process memory and cause service termination.

Root Cause

The root cause is an incorrect use of the ReadableStream API in lib/fetch/index.js. The start callback ran a while (true) loop that read from the underlying stream without checking controller.desiredSize. This bypassed the stream's built-in backpressure mechanism, so unread data remained in the internal queue indefinitely.

Attack Vector

Exploitation requires that a Node.js application uses Undici's fetch and issues requests whose responses are not consumed. An attacker who controls or influences the destination URL, or who serves large payloads, can force the process to buffer response bodies. The attack requires network reachability and user interaction in the form of triggering a fetch, but does not require authentication.

javascript

// Security patch in lib/fetch/index.js
// Source: https://github.com/nodejs/undici/commit/87a48113f1f68f60aa09abb07276d7c35467c663

    const byteStream = new ReadableStream({
      readableStream: transformStream.readable,
-     async start (controller) {
+     async pull (controller) {
        const reader = this.readableStream.getReader()

-       while (true) {
+       while (controller.desiredSize >= 0) {
          const { done, value } = await reader.read()

          if (done) {

The patch replaces the eager start callback with a pull callback and gates the read loop on controller.desiredSize >= 0. This restores stream backpressure so bytes are only pulled when a consumer requests them.

Detection Methods for CVE-2024-24750

Indicators of Compromise

Steady increase in resident set size (RSS) of Node.js processes that use fetch
Node.js process crashes with JavaScript heap out of memory errors
Elevated outbound HTTP traffic to attacker-controlled endpoints followed by no application-level response processing
Presence of Undici versions earlier than 6.6.1 in package-lock.json or node_modules

Detection Strategies

Inventory dependencies with npm ls undici to identify vulnerable direct and transitive versions
Run software composition analysis (SCA) against project manifests and container images to flag Undici below 6.6.1
Review application code for fetch() calls where the returned Response object is not awaited, consumed, or explicitly cancelled
Correlate process memory metrics with fetch call volume in application performance monitoring tools

Monitoring Recommendations

Alert on Node.js worker RSS growth exceeding baseline thresholds over rolling time windows
Monitor container OOMKilled events for services that perform outbound HTTP fetches
Track egress request rates from Node.js services to detect abnormal fetch patterns

How to Mitigate CVE-2024-24750

Immediate Actions Required

Upgrade Undici to version 6.6.1 or later in all Node.js applications and container images
Rebuild and redeploy any downstream artifacts that bundle Undici as a transitive dependency
Audit code paths that call fetch() and ensure the response body is consumed or the request is aborted
Apply vendor updates for products that embed Undici, including those listed in the NetApp advisory

Patch Information

The fix is delivered in Undici 6.6.1 via commit 87a48113f1f68f60aa09abb07276d7c35467c663. Refer to GHSA-9f24-jqhm-jfcw for the maintainer advisory.

Workarounds

Always consume the response body, for example by calling await response.text(), await response.json(), or await response.arrayBuffer()
Explicitly cancel unwanted response streams with response.body.cancel() to release buffered data
Set request timeouts and enforce process memory limits to contain resource exhaustion until patching is complete

bash

# Upgrade Undici to a fixed release
npm install undici@^6.6.1

# Verify the installed version
npm ls undici

# Audit for vulnerable transitive dependencies
npm audit --production