CVE-2026-2581
published 2026-03-12CVE-2026-2581: This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS). In vulnerable Undici versions, when…
PriorityP433medium5.9CVSS 3.1
AVNACHPRNUINSUCNINAH
EPSS
0.57%
43.0th percentile
This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS).
In vulnerable Undici versions, when interceptors.deduplicate() is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination.
Impacted users are applications that use Undici’s deduplication interceptor against endpoints that may produce large or long-lived response bodies.
PatchesThe issue has been patched by changing deduplication behavior to stream response chunks to downstream handlers as they arrive (instead of full-body accumulation), and by preventing late deduplication when body streaming has already started.
Users should upgrade to the first official Undici (and Node.js, where applicable) releases that include this patch.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | node-undici | < node-undici 7.24.5+dfsg+~cs3.2.0-1 (forky) | node-undici 7.24.5+dfsg+~cs3.2.0-1 (forky) |
| nodejs | undici | >= 7.17.0 < 7.24.0 | 7.24.0 |
| undici | undici | < 6.24.0; 7.0.0 < 7.24.0 | 6.24.0; 7.0.0 < 7.24.0 |
| undici | undici | >= 7.17.0 < 7.24.0 | 7.24.0 |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
osv5.9MEDIUM
vendor_debian5.9LOW
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS
osv·2026-03-13
CVE-2026-2581 [MEDIUM] Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS
Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS
## Impact
This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS).
In vulnerable Undici versions, when `interceptors.deduplicate()` is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination.
Impacted users are applications that use Undici’s deduplication interceptor against endpoints that may produce large or long-lived response bodies.
## Patches
The issue has been patched by cha
GHSA
Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS
ghsa·2026-03-13
CVE-2026-2581 [MEDIUM] CWE-770 Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS
Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS
## Impact
This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS).
In vulnerable Undici versions, when `interceptors.deduplicate()` is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination.
Impacted users are applications that use Undici’s deduplication interceptor against endpoints that may produce large or long-lived response bodies.
## Patches
The issue has been patched by cha
OSV
CVE-2026-2581: This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS)
osv·2026-03-12·CVSS 5.9
CVE-2026-2581 [MEDIUM] CVE-2026-2581: This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS)
This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS). In vulnerable Undici versions, when interceptors.deduplicate() is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination. Impacted users are applications that use Undici’s deduplication interceptor against endpoints that may produce large or long-lived response bodies. PatchesThe issue has been patched by changing deduplication behavior to stream response chunks to downstream handlers as they arrive (instead of full-body accumulation),
Red Hat
undici: Undici: Denial of Service due to uncontrolled resource consumption
vendor_redhat·2026-03-12·CVSS 5.9
CVE-2026-2581 [MEDIUM] CWE-770 undici: Undici: Denial of Service due to uncontrolled resource consumption
undici: Undici: Denial of Service due to uncontrolled resource consumption
This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS).
In vulnerable Undici versions, when interceptors.deduplicate() is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination.
Impacted users are applications that use Undici’s deduplication interceptor against endpoints that may produce large or long-lived response bodies.
PatchesThe issue has been patched by changing deduplication behavior to stream response chunks
Debian
CVE-2026-2581: node-undici - This is an uncontrolled resource consumption vulnerability (CWE-400) that can le...
vendor_debian·2026·CVSS 5.9
CVE-2026-2581 [MEDIUM] CVE-2026-2581: node-undici - This is an uncontrolled resource consumption vulnerability (CWE-400) that can le...
This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS). In vulnerable Undici versions, when interceptors.deduplicate() is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination. Impacted users are applications that use Undici’s deduplication interceptor against endpoints that may produce large or long-lived response bodies. PatchesThe issue has been patched by changing deduplication behavior to stream response chunks to downstream handlers as they arrive (instead of full-body accumulation),
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-2581 nodejs22: Undici: Denial of Service due to uncontrolled resource consumption [fedora-all]
bugzilla·2026-03-12·CVSS 5.9
CVE-2026-2581 [MEDIUM] CVE-2026-2581 nodejs22: Undici: Denial of Service due to uncontrolled resource consumption [fedora-all]
CVE-2026-2581 nodejs22: Undici: Denial of Service due to uncontrolled resource consumption [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This CVE was raised against undici version from 7.17.0 up to 7.24.0 (excluding). Nodejs22 has version 6.24.1 - one version behind meaning this isn't affected.
https://github.com/nodejs/undici/security/advisories/GHSA-phc3-fgpg-7m6h
Bugzilla
CVE-2026-2581 undici: Undici: Denial of Service due to uncontrolled resource consumption
bugzilla·2026-03-12·CVSS 5.9
CVE-2026-2581 [MEDIUM] CVE-2026-2581 undici: Undici: Denial of Service due to uncontrolled resource consumption
CVE-2026-2581 undici: Undici: Denial of Service due to uncontrolled resource consumption
This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS).
In vulnerable Undici versions, when interceptors.deduplicate() is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination.
Impacted users are applications that use Undici’s deduplication interceptor against endpoints that may produce large or long-lived response bodies.
PatchesThe issue has been patched by changing deduplication behavior to strea
Bugzilla
CVE-2026-2581 nodejs20: Undici: Denial of Service due to uncontrolled resource consumption [fedora-all]
bugzilla·2026-03-12·CVSS 5.9
CVE-2026-2581 [MEDIUM] CVE-2026-2581 nodejs20: Undici: Denial of Service due to uncontrolled resource consumption [fedora-all]
CVE-2026-2581 nodejs20: Undici: Denial of Service due to uncontrolled resource consumption [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
CVE is raised against undici version 7.X, while nodejs20 is using version 6.4.1 and should not be affected.
Based of https://nvd.nist.gov/vuln/detail/CVE-2026-2581.
Wiz
CVE-2026-2581 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.9
CVE-2026-2581 [MEDIUM] CVE-2026-2581 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-2581 :
JavaScript vulnerability analysis and mitigation
This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS).
In vulnerable Undici versions, when interceptors.deduplicate() is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination.
Impacted users are applications that use Undici’s deduplication interceptor against endpoints that may produce large or long-lived response bodies.
PatchesThe issue has been patched by changing deduplication behavior to stream response chunks to
2026-03-12
Published