CVE-2025-47279: undici Denial of Service attack via bad certificate data
Impact
Applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak.
Patches
This has been patched in https://github.com/nodejs/undici/pull/4088.
Workarounds
If a webhook fails, avoid keep calling it repeatedly.
References
Reported as: https://github.com/nodejs/undici/issues/3895
Other sources
undici Denial of Service attack via bad certificate data
— Microsoft
Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 7.5.0 - Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 6.21.2 - Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 5.29.0 - Upgrade
Upgrade
nodejs/undicito a version that resolves this vulnerability.Fixed in 5.29.0 - Upgrade
Upgrade
nodejs/undicito a version that resolves this vulnerability.Fixed in 6.21.2 - Upgrade
Upgrade
nodejs/undicito a version that resolves this vulnerability.Fixed in 7.5.0 - Compensating control
If a webhook call fails, avoid calling the webhook repeatedly (do not keep retrying in a loop) to reduce the chance of triggering the undici memory leak caused by repeated requests with bad certificate data.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-47279?
CVE-2025-47279 is classified as a critical vulnerability due to its potential for causing memory leaks in applications using the undici library.
How do I fix CVE-2025-47279?
You can mitigate CVE-2025-47279 by upgrading to undici version 7.5.0, 6.21.2, or 5.29.0.
What applications are affected by CVE-2025-47279?
Applications that utilize the undici library for implementing webhook-like systems are affected by CVE-2025-47279.
Can CVE-2025-47279 lead to data loss?
While CVE-2025-47279 primarily causes memory leaks, it can indirectly lead to performance degradation and potential data handling issues.
Is there a specific exploit for CVE-2025-47279?
CVE-2025-47279 can be exploited if an attacker forces the application to repeatedly call a webhook with an invalid certificate.