CVE-2025-47279
📋 TL;DR
Undici HTTP client for Node.js versions before 5.29.0, 6.21.2, and 7.5.0 have a memory leak vulnerability when repeatedly calling webhooks to servers with invalid certificates. This affects applications using undici to implement webhook systems that retry failed connections. Attackers can cause memory exhaustion by forcing repeated calls to malicious servers.
💻 Affected Systems
- undici
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Memory exhaustion leading to application crashes, denial of service, and potential system instability
Likely Case
Gradual memory consumption affecting application performance, potentially requiring restarts
If Mitigated
Minimal impact with proper retry logic and certificate validation
🎯 Exploit Status
Requires attacker to control webhook endpoint with invalid certificate and force repeated calls
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.29.0, 6.21.2, or 7.5.0
Vendor Advisory: https://github.com/nodejs/undici/security/advisories/GHSA-cxrh-j4jr-qwg3
Restart Required: Yes
Instructions:
1. Check current undici version: npm list undici
2. Update to patched version: npm update undici@latest
3. Restart Node.js application
4. Verify update: npm list undici
🔧 Temporary Workarounds
Implement retry logic with circuit breaker
allAvoid repeated calls to failing webhooks by implementing exponential backoff and circuit breaker patterns
Validate webhook endpoints
allImplement certificate validation and endpoint verification before adding to webhook system
🧯 If You Can't Patch
- Implement strict retry limits for failed webhook calls
- Monitor memory usage and restart application if abnormal consumption detected
🔍 How to Verify
Check if Vulnerable:
Check package.json or run: npm list undici | grep undiciCheck Version:
npm list undici | grep undiciVerify Fix Applied:
Confirm version is 5.29.0+, 6.21.2+, or 7.5.0+ via: npm list undici📡 Detection & Monitoring
Log Indicators:
- Repeated connection errors to same endpoint
- Increasing memory usage over time
- Certificate validation failures
Network Indicators:
- Multiple HTTPS requests to same endpoint with certificate errors
- Unusual retry patterns to external endpoints
SIEM Query:
source="application.logs" AND ("certificate error" OR "connection failed") AND count by dest_ip > 10