CVE-2025-47279

LowCVSS 3.1/10Last modified Jun 17, 2026

Description

Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-401

Affected software

Vendor	Product	Versions
nodejs	undici	< 5.29.0; >= 6.0.0, < 6.21.2; >= 7.0.0, < 7.5.0

References

Timeline

Published: May 15, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-47289.8A vulnerability was found in SourceCodester Best Online News Portal 1.0. It has been classified as critical. Affected is an unknown function CVE-2025-472806.1Umbraco Forms is a form builder that integrates with the Umbraco content management system. Starting in the 7.x branch and prior to versions CVE-2025-472817.7Kyverno is a policy engine designed for cloud native platform engineering teams. In versions 1.14.1 and below, a Denial of Service (DoS) vul CVE-2025-472829.9Gardener External DNS Management is an environment to manage external DNS entries for a kubernetes cluster. A security vulnerability was dis CVE-2025-472839.9Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in G CVE-2025-472849.9Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in t CVE-2025-472852.9Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, `concat()` may skip e CVE-2025-472867.2Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, an administrator can, by editing the configur CVE-2025-472877.5Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-data`` parser encounters certain erro CVE-2025-472883.5Discourse Policy plugin gives the ability to confirm users have seen or done something. Prior to version 0.1.1, if there was a policy posted CVE-2025-472899.0CE Phoenix is a free, open-source eCommerce platform. A stored cross-site scripting (XSS) vulnerability was discovered in CE Phoenix version CVE-2025-47296.3A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. It has been declared as critical. Affected by this vulnerabil