LowGHSA-cxrh-j4jr-qwg3CVE-2025-47279

undici Denial of Service attack via bad certificate data

Published 15 May 2025 · Updated 10 Sept 2026

Affected packages

undicinpm

Affected: <5.29.0
Fixed in: 5.29.0

Update to the fixed version for your release line, for example:npm install undici@5.29.0

undicinpm

Affected: >=6.0.0 <6.21.2
Fixed in: 6.21.2

Update to the fixed version for your release line, for example:npm install undici@6.21.2

undicinpm

Affected: >=7.0.0 <7.5.0
Fixed in: 7.5.0

Update to the fixed version for your release line, for example:npm install undici@7.5.0

Details

Impact

Applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak.

Patches

This has been patched in https://github.com/nodejs/undici/pull/4088.

Workarounds

If a webhook fails, avoid keep calling it repeatedly.

References

Reported as: https://github.com/nodejs/undici/issues/3895

Is GHSA-cxrh-j4jr-qwg3 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected undici, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.