CVE-2025-47279

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2025-47279

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-47279.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-47279

Aliases

GHSA-cxrh-j4jr-qwg3

Related

UBUNTU-CVE-2025-47279

Published

2025-05-15T18:15:38Z

Modified

2025-05-19T12:03:40.519630Z

Summary

[none]

Details

Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.

References

Affected packages

Debian:12 / node-undici

Package

Name: node-undici
Purl: pkg:deb/debian/node-undici?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

5.*

5.15.0+dfsg1+~cs20.10.9.3-1

5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1

5.15.0+dfsg1+~cs20.10.9.3-1+deb12u2

5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3

5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4

5.19.1+dfsg1+~cs20.10.9.5-1

5.19.1+dfsg1+~cs20.10.9.5-2

5.22.1+dfsg1+~cs20.10.10.2-1

5.26.3+dfsg1+~cs23.10.12-1

5.26.3+dfsg1+~cs23.10.12-2

5.26.3+dfsg1+~cs23.10.12-3

5.28.0+dfsg1+~cs23.11.12.3-1

5.28.0+dfsg1+~cs23.11.12.3-2

5.28.2+dfsg1+~cs23.11.12.3-1

5.28.2+dfsg1+~cs23.11.12.3-2

5.28.2+dfsg1+~cs23.11.12.3-3

5.28.2+dfsg1+~cs23.11.12.3-4

5.28.2+dfsg1+~cs23.11.12.3-5

5.28.2+dfsg1+~cs23.11.12.3-6

5.28.4+dfsg1+~cs23.12.11-1

5.28.4+dfsg1+~cs23.12.11-2

7.*

7.1.0+dfsg1+~cs24.12.10-1

7.2.3+dfsg1+~cs24.12.11-1

7.2.3+dfsg1+~cs24.12.11-2

7.3.0+dfsg1+~cs24.12.11-1

7.3.0+dfsg1+~cs24.12.11-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / node-undici