{"answers":{"affected":"6 open source packages ship an affected version, including undici.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-47279 exists.","fix":"Upgrade undici to a fixed version for your release line: 5.29.0, 6.21.2 or 7.5.0.","what":"CVE-2025-47279 is a low-severity denial of service vulnerability in nodejs undici, published on 15 May 2025. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-47279 and fix it if it is affected.\n\nWhat it is: CVE-2025-47279 is a low-severity denial of service vulnerability in nodejs undici, published on 15 May 2025. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-47279 exists.\n\nAffected packages and fixed versions:\n- undici (npm): affected all versions; fixed in 5.29.0\n- undici (npm): affected all versions; fixed in 5.29.0\n- undici (npm): affected from 6.0.0; fixed in 6.21.2\n- undici (npm): affected from 6.0.0; fixed in 6.21.2\n- undici (npm): affected from 7.0.0; fixed in 7.5.0\n- undici (npm): affected from 7.0.0; fixed in 7.5.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-47279/ (Markdown: https://insights.sbomify.com/CVE-2025-47279/index.md)","id":"CVE-2025-47279","markdown":"https://insights.sbomify.com/CVE-2025-47279/index.md","name":"CVE-2025-47279","record":{"aliases":["AZL-61895","AZL-61897","DEBIAN-CVE-2025-47279","ECHO-f635-511d-b439","GHSA-cxrh-j4jr-qwg3","MINI-89qf-c3m7-pr5x","MINI-gj6q-jrrr-hpjx","MINI-pp9p-m28m-px2m","ROOT-APP-NPM-CVE-2025-47279","ROOT-OS-DEBIAN-12-CVE-2025-47279","UBUNTU-CVE-2025-47279"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Node.js HTTP client","requires_auth":"low_privilege","summary":"Attackers can cause memory leaks and denial of service in Node.js applications using undici by forcing repeated calls to servers with invalid certificates.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":3.1,"severity":"low","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"cwes":[{"id":"CWE-401","name":"Missing Release of Memory after Effective Lifetime"}],"description":"Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"undici Denial of Service attack via bad certificate data","id":"CVE-2025-47279","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"denial_of_service","year":"2025"},"n_packages":6,"n_references":4,"next":{"headline":"Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow","id":"CVE-2025-47280"},"packages":[{"ecosystem":"npm","fixed":["5.29.0"],"introduced":["0"],"last_affected":[],"package":"undici","purl":null,"source":"GHSA-cxrh-j4jr-qwg3"},{"ecosystem":"npm","fixed":["5.29.0"],"introduced":["0"],"last_affected":[],"package":"undici","purl":"pkg:npm/undici","source":"GHSA-cxrh-j4jr-qwg3"},{"ecosystem":"npm","fixed":["6.21.2"],"introduced":["6.0.0"],"last_affected":[],"package":"undici","purl":null,"source":"GHSA-cxrh-j4jr-qwg3"},{"ecosystem":"npm","fixed":["6.21.2"],"introduced":["6.0.0"],"last_affected":[],"package":"undici","purl":"pkg:npm/undici","source":"GHSA-cxrh-j4jr-qwg3"},{"ecosystem":"npm","fixed":["7.5.0"],"introduced":["7.0.0"],"last_affected":[],"package":"undici","purl":null,"source":"GHSA-cxrh-j4jr-qwg3"},{"ecosystem":"npm","fixed":["7.5.0"],"introduced":["7.0.0"],"last_affected":[],"package":"undici","purl":"pkg:npm/undici","source":"GHSA-cxrh-j4jr-qwg3"}],"prev":{"headline":"Flask uses fallback key instead of current signing key","id":"CVE-2025-47278"},"products":["undici"],"published":"2025-05-15","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-02-06","vendors":["nodejs"]},"summary":"Attackers can cause memory leaks and denial of service in Node.js applications using undici by forcing repeated calls to servers with invalid certificates.","url":"https://insights.sbomify.com/CVE-2025-47279/"}