Executive brief
undici is a popular Node.js HTTP client library used in many applications to make network requests. When undici encounters an invalid SSL/TLS certificate on a remote server, it fails to properly clean up memory resources. Attackers can exploit this by setting up a server with a bad certificate and repeatedly forcing an application to call it (e.g., through webhook retries), causing a memory leak that degrades performance and can eventually crash the application.
Technical details
The vulnerability is a resource leak (CWE-771) in undici's certificate validation handling. When undici processes an invalid certificate during an HTTPS connection, it fails to properly release allocated memory resources, leading to a memory leak. The attack requires network access and relies on an attacker controlling a server with an invalid certificate and being able to trigger repeated requests to that server (e.g., through webhook retry logic). An attacker can cause gradual memory exhaustion and denial of service. Patches are available in versions 5.29.0, 6.21.2, and 7.5.0, and the fix has been merged in PR #4088.
Affected products
- Node.js undici < 5.29.0, 6.0.0 - 6.21.1, 7.0.0 - 7.4.x
Timeline
- 2025-05-15: disclosed: GitHub Security Advisory GHSA-cxrh-j4jr-qwg3 published
- 2025-05-15: patched: Patches released in versions 5.29.0, 6.21.2, and 7.5.0