Memory Leak Vulnerability in Node.js HTTP Client Undici
Summary
CVE-2025-47279: Undici is an HTTP/1.1 client for Node.js. Affects node-undici versions 5.15.0+dfsg1+~cs20.10.9.3-1 – 7.3.0+dfsg1+~cs24.12.11-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Undici is an HTTP/1.1 client designed for Node.js, known for its performance and efficiency in handling HTTP requests. It is widely used in applications that require reliable and fast network communication. However, prior to versions 5.29.0, 6.21.2, and 7.5.0, Undici had a critical vulnerability that could lead to memory leaks when improperly handling webhook calls.
Vulnerability Detail
The vulnerability arises when applications using Undici implement a webhook-like system. If an attacker sets up a server with an invalid SSL certificate and forces the application to repeatedly call the webhook, it can result in a memory leak. This issue can degrade application performance and potentially lead to service outages, as the memory consumption increases without being released.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid calling a webhook repeatedly if the webhook fails. Implement logic to limit the number of retries or to back off after a failure to prevent memory leaks.
Conclusion
The memory leak vulnerability in the Undici HTTP client for Node.js poses a significant risk for applications using webhook systems. It is crucial to update to the latest patched versions to ensure application stability and performance. Implementing workarounds can help mitigate risks until updates are applied.
See every vulnerability recorded for node-undici →
FAQ
The memory leak can lead to increased memory consumption, which may degrade application performance and cause service outages.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The patched versions of Undici are 5.29.0, 6.21.2, and 7.5.0.
If you cannot update immediately, implement a workaround by avoiding repeated calls to failing webhooks to mitigate the risk of memory leaks.
Yes, Vulert can automate vulnerability checks by monitoring your manifest files like package-lock.json for any open-source vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for node-undici.
