[22] [LOW] undici Denial of Service attack via bad certificate data #462

New issue

Open

opened 2025-06-04 22:11:19 +01:00 by Vylpes · 1 comment

Vylpes commented

2025-06-04 22:11:19 +01:00

Owner

Package: undici
Affected versions: >= 6.0.0, < 6.21.2
Patched version: 6.21.2

Impact

Applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak.

Patches

This has been patched in nodejs/undici#4088.

Workarounds

If a webhook fails, avoid keep calling it repeatedly.

Package: `undici` Affected versions: `>= 6.0.0, < 6.21.2` Patched version: `6.21.2` --- ## Impact Applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. ## Patches This has been patched in nodejs/undici#4088. ## Workarounds If a webhook fails, avoid keep calling it repeatedly.