CVE-2026-2581: Undici Unbounded Memory Consumption Vulnerability Leading to DoS
Summary
CVE-2026-2581: Impact This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS). Affects undici versions >= 7.17.0, < 7.24.0. Fixed in 7.24.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Undici is a high-performance HTTP/1.1 client designed for Node.js, providing a simple and efficient way to make HTTP requests. It features advanced capabilities such as connection pooling, request deduplication, and streaming. However, certain versions of Undici are vulnerable to an unbounded memory consumption issue when using the deduplication feature, which can lead to Denial of Service (DoS) attacks.
Vulnerability Detail
The vulnerability arises from uncontrolled resource consumption (CWE-400) when the 'interceptors.deduplicate()' feature is enabled. In affected versions, response data for deduplicated requests can accumulate in memory, especially when dealing with large or chunked responses from untrusted upstream endpoints. This can lead to excessive memory usage and potential out-of-memory (OOM) termination of the process, impacting application availability.
How To Fix
Latest published version: 8.12.3 as of 22 Oct 2026
npm install undici@8.12.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.24.0
This is the first release that contains the fix.
npm install undici@7.24.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing the following workarounds:
- Disable the deduplication feature by removing or commenting out the 'interceptors.deduplicate()' configuration for affected clients or routes.
- Use the 'skipHeaderNames' option with a marker header to bypass deduplication for high-risk requests.
- Avoid making concurrent identical requests to untrusted endpoints that may return large or chunked bodies.
- Set response-size and timeout limits on upstream or proxy servers.
Conclusion
The vulnerability identified as CVE-2026-2581 in Undici can lead to significant resource consumption and potential Denial of Service. Users are strongly advised to upgrade to the patched version or implement workarounds to protect their applications from exploitation.
See every vulnerability recorded for undici →
FAQ
The CVSS score for this vulnerability is 5.9, indicating a moderate severity level.
Undici versions prior to 7.24.0 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup at Vulert Scanner.
Exploitation of this vulnerability can lead to Denial of Service (DoS), causing applications to become unresponsive due to excessive memory consumption.
If immediate upgrading is not possible, consider disabling the deduplication feature or implementing the suggested workarounds to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for undici.
