CVE-2025-47279CWE-401

undici Denial of Service attack via bad certificate data

Low · published May 15, 2025

CVSS v3.1
3.1
EPSS
0%
Percentile
26.0
In the wild
Unconfirmed
What it is

Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00339 · 26.0th percentile
Weakness
CWE-401 · Missing Release of Memory after Effective Lifetime
Published
2025-05-15T17:16Z
EPSS history
Timeline
  • 15 MAY 17:16Z
    undici Denial of Service attack via bad certificate data
    cvelistv5