Memory Leak Vulnerability in Undici HTTP Client for Node.js
CVE-2025-47279

3.1LOW

Key Information:

Vendor

Nodejs

Status
Undici
Vendor
CVE Published:
15 May 2025

What is CVE-2025-47279?

The Undici HTTP/1.1 client for Node.js contains a vulnerability that can be exploited by attackers to trigger a memory leak during repeated webhook calls. This occurs when an application interacts with a malicious server that presents an invalid certificate. If such calls are made continuously despite webhook failures, the application may consume excessive memory, leading to degraded performance or crashes. The issue has been addressed in versions 5.29.0, 6.21.2, and 7.5.0. It is advised to implement a safeguard that avoids repeated webhook calls if the initial call fails.

Affected Version(s)

undici < 5.29.0 < 5.29.0

undici >= 6.0.0, < 6.21.2 < 6.0.0, 6.21.2

undici >= 7.0.0, < 7.5.0 < 7.0.0, 7.5.0

References

https://github.com/nodejs/undici/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/nodejs/undici/issues/3895
x_refsource_MISC
https://github.com/nodejs/undici/pull/4088
x_refsource_MISC

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.