GHSA-cxrh-j4jr-qwg3

undici Denial of Service attack via bad certificate data

Source: GitHub Advisory Database (reviewed) Low CVE-2025-47279

Packages

Ecosystem	Package	Affected	Fixed in
npm	undici	< 5.29.0	5.29.0
npm	undici	>= 6.0.0, < 6.21.2	6.21.2
npm	undici	>= 7.0.0, < 7.5.0	7.5.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. ### Patches This has been patched in https://github.com/nodejs/undici/pull/4088. ### Workarounds If a webhook fails, avoid keep calling it repeatedly. ### References Reported as: https://github.com/nodejs/undici/issues/3895

References

External links from the advisory. They lead to third-party sites.

https://github.com/nodejs/undici/security/advisories/GHSA-cxrh-j4jr-qwg3 web
https://nvd.nist.gov/vuln/detail/CVE-2025-47279 advisory
https://github.com/nodejs/undici/issues/3895 web
https://github.com/nodejs/undici/pull/4088 web
https://github.com/nodejs/undici/commit/f317618ec28753a4218beccea048bcf89c36db25 web
https://github.com/nodejs/undici package