{"id":"CVE-2025-47279","aliases":["AZL-61895","AZL-61897","CLSA-2026-1772583202","CLSA-2026-1784336934","CLSA-2026-1788560495","CLSA-2026-1790542220","CLSA-2026-1791028079","CLSA-2026-1791973587","CLSA-2026-1792867313","DEBIAN-CVE-2025-47279","EUVD-2025-15389","GHSA-cxrh-j4jr-qwg3","ROOT-APP-NPM-CVE-2025-47279","ROOT-OS-DEBIAN-12-CVE-2025-47279","UBUNTU-CVE-2025-47279"],"status":"published","title":"undici Denial of Service attack via bad certificate data","description":"Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.","severity":{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00339,"percentile":0.27618,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-401"],"published":"2025-05-15T14:15:06Z","modified":"2026-10-29T18:15:03Z","fixes":[{"ecosystem":"npm","package":"undici","fixed_in":["5.29.0","6.21.2","7.5.0"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"nodejs18","fixed_in":["18.20.3-6"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"nodejs","fixed_in":["20.14.0-8"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-undici","fixed_in":["7.24.5+dfsg+~cs3.2.0-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"undici","fixed_in":["6.21.2-aikido.6","5.29.0-aikido.3","7.5.0-aikido.6","5.29.0-aikido.4","6.21.2-aikido.7","5.29.0-aikido.5","5.29.0-aikido.6","7.5.0-aikido.7","7.5.0-aikido.8"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/undici","fixed_in":["6.21.2-root.io.1","7.5.0-root.io.1","6.21.2-root.io.2","7.5.0-root.io.2","7.5.0-root.io.3","6.21.2-root.io.3","6.21.2-root.io.4","7.5.0-root.io.4","6.21.2-root.io.5","7.5.0-root.io.5","5.29.0-root.io.1","5.29.0-root.io.2","6.21.2-root.io.6","5.29.0-root.io.3","7.5.0-root.io.6","5.29.0-root.io.4","6.21.2-root.io.7","5.29.0-root.io.5","5.29.0-root.io.6","7.5.0-root.io.7","7.5.0-root.io.8"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"node-undici","fixed_in":["5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.4","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.5","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.aikido.6"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-node-undici","fixed_in":["5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.4","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.5","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.aikido.6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.29.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.21.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.5.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.3-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.14.0-8"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.1-tuxcare.0"},{"fixed":"6.11.1-tuxcare.1"}]}],"versions":["6.11.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.28.5-tuxcare.0"},{"fixed":"5.28.5-tuxcare.5"}]}],"versions":["5.28.5","5.28.5-tuxcare.1","5.28.5-tuxcare.2","5.28.5-tuxcare.3","5.28.5-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.1-tuxcare.0"},{"fixed":"5.5.1-tuxcare.1"}]}],"versions":["5.5.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.19.7-tuxcare.0"},{"fixed":"6.19.7-tuxcare.1"}]}],"versions":["6.19.7"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.19.5-tuxcare.0"},{"fixed":"6.19.5-tuxcare.2"}]}],"versions":["6.19.5","6.19.5-tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.20.0-tuxcare.0"},{"fixed":"6.20.0-tuxcare.3"}]}],"versions":["6.20.0","6.20.0-tuxcare.1","6.20.0-tuxcare.2"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici-types","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.20.0-tuxcare.0"},{"fixed":"6.20.0-tuxcare.3"}]}],"versions":["6.20.0","6.20.0-tuxcare.1","6.20.0-tuxcare.2"],"bundled":15},{"source":"osv","ecosystem":"Debian:12","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0+dfsg1+~cs20.10.9.3-1","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u2","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4","5.19.1+dfsg1+~cs20.10.9.5-1","5.19.1+dfsg1+~cs20.10.9.5-2","5.22.1+dfsg1+~cs20.10.10.2-1","5.26.3+dfsg1+~cs23.10.12-1","5.26.3+dfsg1+~cs23.10.12-2","5.26.3+dfsg1+~cs23.10.12-3","5.28.0+dfsg1+~cs23.11.12.3-1","5.28.0+dfsg1+~cs23.11.12.3-2","5.28.2+dfsg1+~cs23.11.12.3-1","5.28.2+dfsg1+~cs23.11.12.3-2","5.28.2+dfsg1+~cs23.11.12.3-3","5.28.2+dfsg1+~cs23.11.12.3-4","5.28.2+dfsg1+~cs23.11.12.3-5","5.28.2+dfsg1+~cs23.11.12.3-6","5.28.4+dfsg1+~cs23.12.11-1","5.28.4+dfsg1+~cs23.12.11-2","7.1.0+dfsg1+~cs24.12.10-1","7.15.0+dfsg+~cs3.2.0-1","7.15.0+dfsg+~cs3.2.0-3","7.16.0+dfsg+~cs3.2.0-1","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.2.3+dfsg1+~cs24.12.11-1","7.2.3+dfsg1+~cs24.12.11-2","7.24.5+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-2","7.24.6+dfsg+~cs3.2.0-3","7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2","8.5.0+dfsg+~cs3.2.0-1","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.15.0+dfsg+~cs3.2.0-1","7.15.0+dfsg+~cs3.2.0-3","7.16.0+dfsg+~cs3.2.0-1","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.24.5+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-2","7.24.6+dfsg+~cs3.2.0-3","7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2","8.5.0+dfsg+~cs3.2.0-1","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.24.5+dfsg+~cs3.2.0-1"}]}],"versions":["7.15.0+dfsg+~cs3.2.0-1","7.15.0+dfsg+~cs3.2.0-3","7.16.0+dfsg+~cs3.2.0-1","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2"]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.29.0"}]}]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.21.2"}]}]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.5.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.21.2-aikido.6"},{"fixed":"5.29.0-aikido.3"},{"fixed":"7.5.0-aikido.6"},{"fixed":"5.29.0-aikido.4"},{"fixed":"6.21.2-aikido.7"},{"fixed":"5.29.0-aikido.5"},{"fixed":"5.29.0-aikido.6"},{"fixed":"7.5.0-aikido.7"},{"fixed":"7.5.0-aikido.8"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.21.2-root.io.1"},{"fixed":"7.5.0-root.io.1"},{"fixed":"6.21.2-root.io.2"},{"fixed":"7.5.0-root.io.2"},{"fixed":"7.5.0-root.io.3"},{"fixed":"6.21.2-root.io.3"},{"fixed":"6.21.2-root.io.4"},{"fixed":"7.5.0-root.io.4"},{"fixed":"6.21.2-root.io.5"},{"fixed":"7.5.0-root.io.5"},{"fixed":"5.29.0-root.io.1"},{"fixed":"5.29.0-root.io.2"},{"fixed":"6.21.2-root.io.6"},{"fixed":"5.29.0-root.io.3"},{"fixed":"7.5.0-root.io.6"},{"fixed":"5.29.0-root.io.4"},{"fixed":"6.21.2-root.io.7"},{"fixed":"5.29.0-root.io.5"},{"fixed":"5.29.0-root.io.6"},{"fixed":"7.5.0-root.io.7"},{"fixed":"7.5.0-root.io.8"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.4"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.5"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.aikido.6"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.4"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.5"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.aikido.6"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.22.1+dfsg1+~cs20.10.10.2-1ubuntu1","5.26.3+dfsg1+~cs23.10.12-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.18.2+dfsg+~cs3.2.0-1build1","7.24.6+dfsg+~cs3.2.0-3","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.3.0+dfsg1+~cs24.12.11-2","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.18.2+dfsg+~cs3.2.0-1build1"]}],"products":[{"vendor":"nodejs","product":"undici"},{"vendor":"undici","product":"undici"}],"references":[{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-cxrh-j4jr-qwg3","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/nodejs/undici/issues/3895","tags":["x_refsource_MISC","report","web"]},{"url":"https://github.com/nodejs/undici/pull/4088","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/nodejs/undici/commit/f317618ec28753a4218beccea048bcf89c36db25","tags":["x_refsource_MISC","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47279","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-cxrh-j4jr-qwg3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47279.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-47279","tags":["advisory"]},{"url":"https://github.com/nodejs/undici","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2025-47279","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-47279","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-47279","title":"undici Denial of Service attack via bad certificate data","description":"Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.","status":"published","published":"2025-05-15T17:16:02.738Z","modified":"2026-02-06T19:14:56.281Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:32:25.982948Z"}],"euvd":[{"id":"EUVD-2025-15389","description":"Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.","status":"published","published":"2025-05-15T17:16:02Z","modified":"2026-02-06T19:14:56Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T19:48:42.836553Z"}],"ghsa":[{"id":"GHSA-cxrh-j4jr-qwg3","title":"undici Denial of Service attack via bad certificate data","description":"### Impact\n\nApplications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. \n\n### Patches\n\nThis has been patched in https://github.com/nodejs/undici/pull/4088.\n\n### Workarounds\n\nIf a webhook fails, avoid keep calling it repeatedly.\n\n### References\n\nReported as: https://github.com/nodejs/undici/issues/3895","status":"published","published":"2025-05-15T14:15:06Z","modified":"2026-02-06T21:35:54Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:39:23.728882Z"}],"nvd":[{"id":"CVE-2025-47279","description":"Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.","status":"published","published":"2025-05-15T18:15:38.027Z","modified":"2026-06-17T09:27:39.467Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:11:08.321805Z"}],"osv":[{"id":"CVE-2025-47279","title":"undici Denial of Service attack via bad certificate data","description":"Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.","status":"published","published":"2025-05-15T17:16:02.738Z","modified":"2026-10-28T02:30:52.758442708Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T15:44:49.707645Z"},{"id":"DEBIAN-CVE-2025-47279","description":"Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.","status":"published","published":"2025-05-15T18:15:38.027Z","modified":"2026-09-01T20:05:52.973751129Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"GHSA-cxrh-j4jr-qwg3","title":"undici Denial of Service attack via bad certificate data","description":"### Impact\n\nApplications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. \n\n### Patches\n\nThis has been patched in https://github.com/nodejs/undici/pull/4088.\n\n### Workarounds\n\nIf a webhook fails, avoid keep calling it repeatedly.\n\n### References\n\nReported as: https://github.com/nodejs/undici/issues/3895","status":"published","published":"2025-05-15T14:15:06Z","modified":"2026-09-10T03:50:24.485053177Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T15:46:45.639885Z"},{"id":"ROOT-APP-NPM-CVE-2025-47279","title":"CVE-2025-47279 in undici - Patched by Root","description":"Root has patched CVE-2025-47279 in the undici package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-29T17:31:21Z","modified":"2026-10-29T18:15:03.240426616Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2025-47279","title":"CVE-2025-47279 in node-undici - Patched by Root","description":"Root has patched CVE-2025-47279 in the node-undici package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-25T12:14:35Z","modified":"2026-08-26T01:12:54.33992613Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:53:31.514195Z"},{"id":"UBUNTU-CVE-2025-47279","description":"Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.","status":"published","published":"2025-05-15T18:15:00Z","modified":"2026-10-17T12:56:59.336786736Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"AZL-61895","title":"CVE-2025-47279 affecting package nodejs18 for versions less than 18.20.3-6","description":"Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.","status":"published","published":"2025-05-15T18:15:38Z","modified":"2026-04-21T04:31:52.787716Z","updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"AZL-61897","title":"CVE-2025-47279 affecting package nodejs for versions less than 20.14.0-8","description":"Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.","status":"published","published":"2025-05-15T18:15:38Z","modified":"2026-06-02T05:26:23Z","updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"CLSA-2026-1772583202","title":"TuxCare security update for undici (3 CVEs)","description":"TuxCare rebuilt undici to address 3 CVEs. Fixed in 6.11.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:10Z","modified":"2026-10-15T09:45:26.478895396Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1784336934","title":"TuxCare security update for undici (3 CVEs)","description":"TuxCare rebuilt undici to address 3 CVEs. Fixed in 5.28.5-tuxcare.5.","status":"published","published":"2026-08-04T14:52:44Z","modified":"2026-10-23T19:28:14.203538651Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1788560495","title":"TuxCare security update for undici (14 CVEs)","description":"TuxCare rebuilt undici to address 14 CVEs. Fixed in 5.5.1-tuxcare.1.","status":"published","published":"2026-09-04T22:21:35Z","modified":"2026-10-15T09:48:03.135244229Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1790542220","title":"TuxCare security update for undici (12 CVEs)","description":"TuxCare rebuilt undici to address 12 CVEs. Fixed in 6.19.7-tuxcare.1.","status":"published","published":"2026-09-27T20:50:20Z","modified":"2026-10-15T09:45:09.792474642Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791028079","title":"TuxCare security update for undici (11 CVEs)","description":"TuxCare rebuilt undici to address 11 CVEs. Fixed in 6.19.5-tuxcare.2.","status":"published","published":"2026-10-03T11:47:59Z","modified":"2026-10-15T09:47:57.895518604Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791973587","title":"TuxCare security update for undici (15 CVEs)","description":"TuxCare rebuilt undici to address 15 CVEs. Fixed in 6.20.0-tuxcare.3.","status":"published","published":"2026-10-14T10:26:27Z","modified":"2026-10-24T19:15:03.446818583Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792867313","title":"TuxCare security update for undici-types (15 CVEs)","description":"TuxCare rebuilt undici-types to address 15 CVEs. Fixed in 6.20.0-tuxcare.3.","status":"published","published":"2026-10-24T18:41:49Z","modified":"2026-10-25T01:30:04.32437095Z","updated_at":"2026-11-02T15:43:54.981307Z"}]}}