GHSA-cxrh-j4jr-qwg3LowCVSS 3.1

undici Denial of Service attack via bad certificate data

Published
May 15, 2025
Last Modified
February 6, 2026

🔗 CVE IDs covered (1)

CVE-2025-47279 →

📋 Description

Impact

Applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak.

Patches

This has been patched in https://github.com/nodejs/undici/pull/4088.

Workarounds

If a webhook fails, avoid keep calling it repeatedly.

References

Reported as: https://github.com/nodejs/undici/issues/3895

🎯 Affected products3

  • npm/undici:< 5.29.0
  • npm/undici:>= 6.0.0, < 6.21.2
  • npm/undici:>= 7.0.0, < 7.5.0

🔗 References (6)