CVE-2025-47279: undici Denial of Service attack via bad certificate data

Severity: low (CVSS 3.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-05-15 · updated 2026-06-17
Weakness: CWE-401

Description

Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.

Affected products

Npm Undici: before 5.29.0; from 6.0.0 before 6.21.2; from 7.0.0 before 7.5.0 — fixed in 5.29.0, 6.21.2, 7.5.0
undici: before 5.29.0; from 6.0.0, < 6.21.2; from 7.0.0, < 7.5.0

How to fix

Upgrade to a fixed version: Npm Undici 5.29.0, 6.21.2, 7.5.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-47279 or the next vulnerability affects your stack