Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2025-47279
Good to know:
Date: May 15, 2025
Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.
Severity Score
Related Resources (6)
Severity Score
Weakness Type (CWE)
Missing Release of Memory after Effective Lifetime
CWE-401Top Fix
Upgrade Version
Upgrade to version undici - 5.29.0;undici - 6.21.2;undici - 7.5.0;https://github.com/nodejs/undici.git - v7.5.0;https://github.com/nodejs/undici.git - v6.21.2;https://github.com/nodejs/undici.git - v5.29.0
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | NETWORK |
| Attack Complexity (AC): | HIGH |
| Privileges Required (PR): | LOW |
| User Interaction (UI): | NONE |
| Scope (S): | UNCHANGED |
| Confidentiality (C): | NONE |
| Integrity (I): | NONE |
| Availability (A): | LOW |