CVE-2025-47279
published 2025-05-15CVE-2025-47279: Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are…
low3.1CVSS 3.1
AVNACHPRLUINSUCNINAL
Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | node-undici | < node-undici 7.24.5+dfsg+~cs3.2.0-1 (forky) | node-undici 7.24.5+dfsg+~cs3.2.0-1 (forky) |
| msrc | azl3_nodejs_20.14.0-8_on_azure_linux_3.0 | — | — |
| msrc | azl3_nodejs_20.14.0-9_on_azure_linux_3.0 | — | — |
| msrc | cbl2_nodejs18_18.20.3-6_on_cbl_mariner_2.0 | — | — |
| nodejs | undici | < 5.29.0 | 5.29.0 |
| nodejs | undici | — | — |
| nodejs | undici | — | — |
| nodejs | undici | >= 0 < 5.29.0 | 5.29.0 |
| nodejs | undici | >= 6.0.0 < 6.21.2 | 6.21.2 |
| nodejs | undici | >= 7.0.0 < 7.5.0 | 7.5.0 |
CVSS provenance
nvdv3.13.1LOWCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
osv3.1LOW