CVE-2026-2581: undici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoS
Impact This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS).
In vulnerable Undici versions, when interceptors.deduplicate() is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination.
Impacted users are applications that use Undici’s deduplication interceptor against endpoints that may produce large or long-lived response bodies.
Patches
The issue has been patched by changing deduplication behavior to stream response chunks to downstream handlers as they arrive (instead of full-body accumulation), and by preventing late deduplication when body streaming has already started.
Users should upgrade to the first official Undici (and Node.js, where applicable) releases that include this patch.
Workarounds If upgrading immediately is not possible:
- Disable interceptors.deduplicate() for affected clients/routes. - Use skipHeaderNames with a marker header to force high-risk requests to bypass deduplication. - Avoid concurrent identical requests to untrusted endpoints that may return very large/chunked bodies. - Apply upstream/proxy response-size and timeout limits.
Other sources
This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS).
In vulnerable Undici versions, when interceptors.deduplicate() is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination.
Impacted users are applications that use Undici’s deduplication interceptor against endpoints that may produce large or long-lived response bodies.
PatchesThe issue has been patched by changing deduplication behavior to stream response chunks to downstream handlers as they arrive (instead of full-body accumulation), and by preventing late deduplication when body streaming has already started.
Users should upgrade to the first official Undici (and Node.js, where applicable) releases that include this patch.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 7.24.0 - Configuration
Disable `interceptors.deduplicate()` for affected clients/routes that call endpoints capable of returning large or long-lived response bodies.
Undici (deduplication interceptor) interceptors.deduplicate() = disabled - Configuration
Use `skipHeaderNames` with a marker header so high-risk requests bypass deduplication and do not trigger response buffering behavior.
Undici (deduplication interceptor) skipHeaderNames (with marker header) = configured to force high-risk requests to bypass deduplication - Compensating control
Apply upstream/proxy response-size and timeout limits to prevent attacker-controlled untrusted upstreams from returning very large or long-lived/chunked response bodies.
- Compensating control
Avoid concurrent identical requests to untrusted endpoints that may return very large/chunked responses to reduce the chance of high memory usage in Undici deduplication.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2581?
CVE-2026-2581 is classified as a high severity vulnerability due to its potential to cause Denial of Service (DoS) through unbounded memory consumption.
How does CVE-2026-2581 affect applications using Undici?
CVE-2026-2581 can lead to uncontrolled resource consumption in applications using Undici, resulting in a Denial of Service condition.
Which versions of Undici are affected by CVE-2026-2581?
CVE-2026-2581 affects all vulnerable versions of Undici, specifically those with the deduplication handler issue.
How do I mitigate CVE-2026-2581?
To mitigate CVE-2026-2581, update to the latest version of Undici that addresses the unbounded memory consumption issue.
What is the main cause of CVE-2026-2581?
The main cause of CVE-2026-2581 is the unregulated response buffering in Undici's DeduplicationHandler.