CVE-2025-47279
published 2025-05-15CVE-2025-47279: Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are…
PriorityP410low3.1CVSS 3.1
AVNACHPRLUINSUCNINAL
EPSS
0.27%
18.2th percentile
Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | node-undici | < node-undici 7.24.5+dfsg+~cs3.2.0-1 (forky) | node-undici 7.24.5+dfsg+~cs3.2.0-1 (forky) |
| msrc | azl3_nodejs_20.14.0-8_on_azure_linux_3.0 | — | — |
| msrc | azl3_nodejs_20.14.0-9_on_azure_linux_3.0 | — | — |
| msrc | cbl2_nodejs18_18.20.3-6_on_cbl_mariner_2.0 | — | — |
| nodejs | undici | < 5.29.0 | 5.29.0 |
| nodejs | undici | — | — |
| nodejs | undici | — | — |
| nodejs | undici | >= 0 < 5.29.0 | 5.29.0 |
| nodejs | undici | >= 6.0.0 < 6.21.2 | 6.21.2 |
| nodejs | undici | >= 7.0.0 < 7.5.0 | 7.5.0 |
CVSS provenance
nvdv3.13.1LOWCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
osv3.1LOW
vendor_debian3.1LOW
vendor_msrc3.1LOW
vendor_redhat3.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2025-47279: Undici is an HTTP/1
osv·2025-05-15·CVSS 3.1
CVE-2025-47279 [LOW] CVE-2025-47279: Undici is an HTTP/1
Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.
OSV
undici Denial of Service attack via bad certificate data
osv·2025-05-15
CVE-2025-47279 [LOW] undici Denial of Service attack via bad certificate data
undici Denial of Service attack via bad certificate data
### Impact
Applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak.
### Patches
This has been patched in https://github.com/nodejs/undici/pull/4088.
### Workarounds
If a webhook fails, avoid keep calling it repeatedly.
### References
Reported as: https://github.com/nodejs/undici/issues/3895
GHSA
undici Denial of Service attack via bad certificate data
ghsa·2025-05-15
CVE-2025-47279 [LOW] CWE-401 undici Denial of Service attack via bad certificate data
undici Denial of Service attack via bad certificate data
### Impact
Applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak.
### Patches
This has been patched in https://github.com/nodejs/undici/pull/4088.
### Workarounds
If a webhook fails, avoid keep calling it repeatedly.
### References
Reported as: https://github.com/nodejs/undici/issues/3895
Red Hat
undici: Undici Memory Leak with Invalid Certificates
vendor_redhat·2025-05-15·CVSS 3.1
CVE-2025-47279 [LOW] CWE-401 undici: Undici Memory Leak with Invalid Certificates
undici: Undici Memory Leak with Invalid Certificates
Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.
A memory leak vulnerability has been discovered in the Undici HTTP/1.1 client library. This flaw can be triggered by repeatedly calling a webhook endpoint that presents an invalid TLS certificate. Continuous interaction with such an endpoint can cause the Undici library to allocat
Microsoft
undici Denial of Service attack via bad certificate data
vendor_msrc·2025-05-13·CVSS 3.1
CVE-2025-47279 [LOW] CWE-401 undici Denial of Service attack via bad certificate data
undici Denial of Service attack via bad certificate data
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https:
Debian
CVE-2025-47279: node-undici - Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and ...
vendor_debian·2025·CVSS 3.1
CVE-2025-47279 [LOW] CVE-2025-47279: node-undici - Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and ...
Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.
Scope: local
bookworm: open
forky: resolved (fixed in 7.24.5+dfsg+~cs3.2.0-1)
sid: resolved (fixed in 7.24.5+dfsg+~cs3.2.0-1)
trixie: open
No detection rules found.
No public exploits indexed.
2025-05-15
Published