CVE-2025-47279

lowpriority · track · 0EPSS 0.003 · 27 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.34% (27th) EPSS

CVSS 3.1 · low

Is it mine?

15 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.

cvss

Technical severity, 0–10. One row per scoring source.

3.1

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.13.1lowAV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:Lsecondary · FSTEC (BDU) RU

v3.13.1lowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:Lsecondary · ENISA EU

v3.13.1lowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:Lsecondary · security-advisories@github.comexploitability 1.6 · impact 1.4

v3.13.1lowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:Lsecondary · OSV

v3.12.9lowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: no · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-401USCWE-401USCWE-401US

affected products (15)

Products and version ranges known to be affected.

IBM App Connect Enterprise Certified Container Operator LTS <12.0.11all versionscert_bundDE
IBM App Connect Enterprise Container Operator <12.10.0all versionscert_bundDE
IBM App Connect Enterprise≤ Container Operator <12.10.0cert_bundDE
IBM App Connect Enterprise≤ Certified Container Operator LTS <12.0.11cert_bundDE
nodejs undici≤ < 5.29.0enisa_euvdEU
nodejs undici6.0.0, → 6.21.2enisa_euvdEU
nodejs undici7.0.0, → 7.5.0enisa_euvdEU
Jenkins NodeJS≤ 22.19.0fstec_bduRU
Node.js Foundation Undici≤ 7.5.0fstec_bduRU
Node.js Foundation Undici≤ 6.21.2fstec_bduRU
Node.js Foundation Undici≤ 5.29.0fstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 8.0fstec_bduRU
npm undici< 5.29.0osvUSpkg:npm/undici
npm undici6.0.0 → 6.21.2osvUSpkg:npm/undici
npm undici7.0.0 → 7.5.0osvUSpkg:npm/undici

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2025-1101IBM App Connect Enterprise: Schwachstelle ermöglicht Denial of ServiceDeutsch2025-05-19csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in IBM App Connect Enterprise ausnutzen, um einen Denial of Service Angriff durchzuführen.
GHSA-cxrh-j4jr-qwg3undici Denial of Service attack via bad certificate data2025-05-15ghsa · osvUS
### Impact Applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. ### Patches This has been patched in https://github.com/nodejs/undici/pull/4088. ### Workarounds If a webhook fails, avoid keep calling it repeatedly. ### References Reported as: https://github.com/nodejs/undici/issues/3895

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund osv NVD CVE.org MITRE

published 2025-05-15modified 2026-09-17

references (12)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan