Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0415 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-47279:
    Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that     use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an     invalid certificate, and they can force the application to call the webhook repeatedly, then they can     cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid     calling a webhook repeatedly if the webhook fails.

    CVE-2025-23167:
    A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead     of the required `\r\n\r\n`.
    This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and     submit unauthorized requests.

    The issue was resolved by upgrading `llhttp` to version 9, which enforces correct header termination.

    Impact:
    * This vulnerability affects only Node.js 20.x users prior to the `llhttp` v9 upgrade.

    CVE-2025-23166:
    The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied     inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations     are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely     crash a Node.js runtime.

    CVE-2025-23165:
    In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`:
    a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This     results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth,     leading to a denial of service.

    Impact:
    * This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that     use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an     invalid certificate, and they can force the application to call the webhook repeatedly, then they can     cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid     calling a webhook repeatedly if the webhook fails. (CVE-2025-47279)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of nodejs / nodejs18 installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-47279 advisory.

  - Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that     use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an     invalid certificate, and they can force the application to call the webhook repeatedly, then they can     cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid     calling a webhook repeatedly if the webhook fails. (CVE-2025-47279)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of nodejs / nodejs18 installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-47279 advisory.

  - Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that     use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an     invalid certificate, and they can force the application to call the webhook repeatedly, then they can     cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid     calling a webhook repeatedly if the webhook fails. (CVE-2025-47279)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1009 advisory.

    Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a     string, resulting in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory     growth, leading to a denial of service.

    Info: https://nodejs.org/en/blog/vulnerability/may-2025-security-releases#corrupted-pointer-in-     nodefsreadfileutf8const-functioncallbackinfovalue-args-when-args0-is-a-string-cve-2025-23165---low     (CVE-2025-23165)

    Improper error handling in async cryptographic operations crashes process

    Info: https://nodejs.org/en/blog/vulnerability/may-2025-security-releases#improper-error-handling-in-     async-cryptographic-operations-crashes-process-cve-2025-23166---high (CVE-2025-23166)

    Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that     use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an     invalid certificate, and they can force the application to call the webhook repeatedly, then they can     cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid     calling a webhook repeatedly if the webhook fails. (CVE-2025-47279)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1010 advisory.

    Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a     string, resulting in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory     growth, leading to a denial of service.

    Info: https://nodejs.org/en/blog/vulnerability/may-2025-security-releases#corrupted-pointer-in-     nodefsreadfileutf8const-functioncallbackinfovalue-args-when-args0-is-a-string-cve-2025-23165---low     (CVE-2025-23165)

    Improper error handling in async cryptographic operations crashes process

    Info: https://nodejs.org/en/blog/vulnerability/may-2025-security-releases#improper-error-handling-in-     async-cryptographic-operations-crashes-process-cve-2025-23166---high (CVE-2025-23166)

    Improper HTTP header block termination in llhttp which enables request smuggling, allowing attackers to     bypass proxy-based access controls and submit unauthorized requests. This vulnerability affects only     Node.js 20.x users prior to the llhttp v9 upgrade.

    Info: https://nodejs.org/en/blog/vulnerability/may-2025-security-releases#improper-http-header-block-     termination-in-llhttp-cve-2025-23167---medium (CVE-2025-23167)

    Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that     use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an     invalid certificate, and they can force the application to call the webhook repeatedly, then they can     cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid     calling a webhook repeatedly if the webhook fails. (CVE-2025-47279)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that
    use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an
    invalid certificate, and they can force the application to call the webhook repeatedly, then they can
    cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid
    calling a webhook repeatedly if the webhook fails. (CVE-2025-47279)

ID	Name	Product	Family	Severity
276095	TencentOS Server 4: nodejs20 (TSSA-2025:0415)	Nessus	Tencent Local Security Checks	medium
250317	Linux Distros Unpatched Vulnerability : CVE-2025-47279	Nessus	Misc.	low
241949	CBL Mariner 2.0 Security Update: nodejs / nodejs18 (CVE-2025-47279)	Nessus	MarinerOS Local Security Checks	low
241941	Azure Linux 3.0 Security Update: nodejs / nodejs18 (CVE-2025-47279)	Nessus	Azure Linux Local Security Checks	low
238268	Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2025-1009)	Nessus	Amazon Linux Local Security Checks	high
238264	Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2025-1010)	Nessus	Amazon Linux Local Security Checks	medium
427555	SCA: security update for undici (GHSA-cxrh-j4jr-qwg3)	Tenable Cloud Security	SCA Checks	low
427555	SCA: security update for undici (GHSA-cxrh-j4jr-qwg3)	Tenable Self-Hosted Container Security	SCA Checks	low

Detections

Analytics

CVE-2025-47279

low

Tenable Plugins

medium

low

low

low

high

medium

low

low