Description
Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nodejs | undici | < 5.29.0, >= 6.0.0, < 6.21.2, >= 7.0.0, < 7.5.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-undici | 7.24.5+dfsg+~cs3.2.0-1 | — |
| Debian 13 | node-undici | No fix yet | — |
| Debian 12 | node-undici | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-undici | No fix yet | — |
| Ubuntu 26.04 LTS | node-undici | No fix yet | — |
| Ubuntu 25.10 | node-undici | No fix yet | — |
| Ubuntu 24.04 LTS | node-undici | No fix yet | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | nodejs20 +4 | 1:20.19.2-1.amzn2023.0.1 | ALAS2023-2025-1010 |
| Amazon Linux 2023 | nodejs20-npm | 1:10.8.2-1.20.19.2.1.amzn2023.0.1 | ALAS2023-2025-1010 |
| Amazon Linux 2023 | nodejs22 +4 | 1:22.16.0-1.amzn2023.0.1 | ALAS2023-2025-1009 |
| Amazon Linux 2023 | nodejs22-npm | 1:10.9.2-1.22.16.0.1.amzn2023.0.1 | ALAS2023-2025-1009 |
| Amazon Linux 2023 | v8-11.3-devel | 3:11.3.244.8-1.20.19.2.1.amzn2023.0.1 | ALAS2023-2025-1010 |
| Amazon Linux 2023 | v8-12.4-devel | 3:12.4.254.21-1.22.16.0.1.amzn2023.0.1 | ALAS2023-2025-1009 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | nodejs | 20.14.0-8 | — |
| Azure Linux 2 (CBL-Mariner) | nodejs18 | 18.20.3-6 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | code-server +1 | 4.100.2-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | undici | < 5.29.0 | 5.29.0 | GHSA-cxrh-j4jr-qwg3 |
| npm | undici | >= 6.0.0, < 6.21.2 | 6.21.2 | GHSA-cxrh-j4jr-qwg3 |
| npm | undici | >= 7.0.0, < 7.5.0 | 7.5.0 | GHSA-cxrh-j4jr-qwg3 |
Advisories 3
- ALAS2023-2025-1009 Important: nodejs22 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 10, 2025
- ALAS2023-2025-1010 Important: nodejs20 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 10, 2025
- WID-SEC-2025-1101 IBM App Connect Enterprise: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · May 19, 2025