CVE-2025-47279

LOW EPSS 16.7%
Published May 15, 20251y ago · Modified Jun 17, 20261w ago
3.1 CVSS 3.1
Low
Find Similar
Published May 15, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.

CVSS Details

Base Score
3.1
Exploitability
1.6
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack Vector Network
Attack Complexity High
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability Low

Threat Intelligence

EPSS Exploit Probability
16.7% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-401

References 4

  • github.com https://github.com/nodejs/undici/commit/f317618ec28753a4218beccea048bcf89c36db25
  • github.com https://github.com/nodejs/undici/issues/3895
  • github.com https://github.com/nodejs/undici/pull/4088
  • github.com https://github.com/nodejs/undici/security/advisories/GHSA-cxrh-j4jr-qwg3

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.