DEBIAN-CVE-2025-47279
Record from OSV · Published May 15, 2025
Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| node-undici | Debian:14 | 7.24.5+dfsg+~cs3.2.0-1 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Debian:14 | node-undici | 0, 7.15.0+dfsg+~cs3.2.0-1, 7.15.0+dfsg+~cs3.2.0-3 |
| Debian:12 | node-undici | 8.9.0+dfsg+~cs3.2.0-1, 7.15.0+dfsg+~cs3.2.0-1, 7.15.0+dfsg+~cs3.2.0-3 |
| Debian:13 | node-undici | 7.15.0+dfsg+~cs3.2.0-1, 7.15.0+dfsg+~cs3.2.0-3, 7.16.0+dfsg+~cs3.2.0-1 |
Timeline
- May 15, 2025 CVE Published
- Sep 1, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln DEBIAN-CVE-2025-47279
vulnetix vdb fixes DEBIAN-CVE-2025-47279Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/DEBIAN-CVE-2025-47279/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart