PT-2025-21343 · Undici+2 · Undici+2

Styfle · Published 2025-05-15 · Updated 2026-03-19 · CVE-2025-47279

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions: Undici versions prior to 5.29.0 Undici versions prior to 6.21.2 Undici versions prior to 7.5.0

Description: The issue affects applications that use Undici to implement a webhook-like system. If an attacker sets up a server with an invalid certificate and forces the application to call the webhook repeatedly, it can cause a memory leak.

Recommendations: For versions prior to 5.29.0, update to version 5.29.0 or later. For versions prior to 6.21.2, update to version 6.21.2 or later. For versions prior to 7.5.0, update to version 7.5.0 or later. As a temporary workaround, avoid calling a webhook repeatedly if the webhook fails.

Exploit

Fix

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

AZL-61895

AZL-61897

BDU:2026-05692

CVE-2025-47279

GHSA-CXRH-J4JR-QWG3

Affected Products

Debian

Red Os

Undici

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47279.json · Exploit
• https://cve.org/CVERecord?id=CVE-2025-47279 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-47279 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05692 · Security Note
• https://osv.dev/vulnerability/CVE-2025-47279 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-61895 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2025-47279 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-47279 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-47279 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cxrh-j4jr-qwg3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-47279 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-47279 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-61897 · Vendor Advisory
• https://github.com/nodejs/undici/security/advisories/GHSA-cxrh-j4jr-qwg3 · Note
• https://github.com/nodejs/undici/commit/f317618ec28753a4218beccea048bcf89c36db25 · Note