| Package | Affected versions | Patched versions |
|---|---|---|
| undici | ≥ 6.0.0, < 6.21.2≥ 7.0.0, < 7.5.0< 5.29.0 | 6.21.27.5.05.29.0 |
Applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak.
This has been patched in https://github.com/nodejs/undici/pull/4088.
If a webhook fails, avoid keep calling it repeatedly.
Reported as: https://github.com/nodejs/undici/issues/3895
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free