Sign in
Deutsch English Español Polski
Low

undici Denial of Service attack via bad certificate data

  • Disclosed: 15.05.2025
  • Updated: 11.10.2026 10:22

Impact

Applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak.

Patches

This has been patched in https://github.com/nodejs/undici/pull/4088.

Workarounds

If a webhook fails, avoid keep calling it repeatedly.

References

Reported as: https://github.com/nodejs/undici/issues/3895

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package undici < 5.29.0, >= 6.0.0, < 6.21.2, >= 7.0.0, < 7.5.0 5.29.0, 6.21.2, 7.5.0

References

CVSS score 3.1/10
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness (CWE)
CWE-401
Platform
npm
Package
undici
Disclosed
15.05.2025
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-cxrh-j4jr-qwg3 - CC BY 4.0

Vulnerability history: undici

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (46) in the archive
Total entries
46
First → latest
06.2022 09.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • High 13
  • Medium 21
  • Low 12

Disclosures per year

Severity:
  1. undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
    High · 7.5 CVE-2026-19534 >= 6.7.0, < 6.28.1, >= 7.0.0, < 7.29.1, >= 8.0.0, < 8.10.2 6.28.1, 7.29.1, 8.10.2
  2. undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool
    High · 7.4 CVE-2026-84961 >= 7.24.1, < 7.29.1, >= 8.0.0, < 8.10.2 7.29.1, 8.10.2
  3. undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors
    High · 7.4 CVE-2026-85152 >= 8.10.0, < 8.10.2 8.10.2
  4. undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
    High · 7.4 CVE-2026-13697 >= 7.0.0, < 7.29.0, >= 8.0.0, < 8.9.0 7.29.0, 8.9.0
  5. undici WebSocket client vulnerable to denial of service via fragment count bypass
    High · 7.5 CVE-2026-12151 < 6.27.0, >= 7.0.0, < 7.28.0, >= 8.0.0, < 8.5.0 6.27.0, 7.28.0, 8.5.0
  6. undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse
    High · 7.5 CVE-2026-6734 >= 7.23.0, < 7.28.0, >= 8.0.0, < 8.2.0 7.28.0, 8.2.0
  7. undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
    High · 7.4 CVE-2026-9697 >= 7.23.0, < 7.28.0, >= 8.0.0, < 8.5.0 7.28.0, 8.5.0
  8. undici WebSocket client vulnerable to denial of service via cumulative fragment bypass
    High · 7.5 CVE-2026-9675 >= 8.0.0, < 8.5.0 8.5.0
  9. Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression
    High · 7.5 CVE-2026-1526 < 6.24.0, >= 7.0.0, < 7.24.0 6.24.0, 7.24.0
  10. Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation
    High · 7.5 CVE-2026-2229 < 6.24.0, >= 7.0.0, < 7.24.0 6.24.0, 7.24.0
  11. Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client
    High · 7.5 CVE-2026-1528 >= 6.0.0, < 6.24.0, >= 7.0.0, < 7.24.0 6.24.0, 7.24.0
  12. undici Denial of Service attack via bad certificate data this entry
    Low · 3.1 CVE-2025-47279 < 5.29.0, >= 6.0.0, < 6.21.2, >= 7.0.0, < 7.5.0 5.29.0, 6.21.2, 7.5.0
  13. Regular Expression Denial of Service in Headers
    High · 7.5 CVE-2023-24807 < 5.19.1 5.19.1
  14. ProxyAgent vulnerable to MITM
    High · 7.7 CVE-2022-32210 >= 4.8.2, < 5.5.1 5.5.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.