CVE intelligence

CVE-2025-47279

Vulnerability intelligence

Published May 15, 2025Sources checked Nov 12, 2026

3.1LOWCVSS out of 10

What this means

Review the available evidence

CVE-2025-47279 and is rated Low severity with a CVSS score of 3.1. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Microsoft Security Response Center guidance

Vendor revision: Aug 12, 2026

CBL-Mariner Releases

Vendor-listed releases

20.14.0-8
18.20.3-6

CISA KEVNot listedBased on the latest collected catalog

EPSS0.3%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2025-47279?

Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable.

If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0.

As a workaound, avoid calling a webhook repeatedly if the webhook fails.

Source: NVD