Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS

The primary impact of CVE-2026-2581 is a Denial of Service (DoS). An attacker can trigger this by sending a large number of identical, concurrent requests to a server utilizing Undici's deduplication interceptor. These requests, when deduplicated, can cause Undici to accumulate response data in memory. If the upstream endpoint is attacker-controlled and sends large or chunked responses, this can rapidly exhaust available memory, leading to an Out-of-Memory (OOM) error and crashing the Node.js process. The blast radius is limited to the affected Node.js application and its dependent services. This vulnerability is similar in concept to other resource exhaustion attacks, but specifically targets the deduplication feature within Undici.

Applications built on Node.js that utilize the Undici HTTP client library and have the interceptors.deduplicate() feature enabled are at risk. This includes applications that proxy requests or act as intermediaries, as they are more likely to handle untrusted upstream endpoints. Services relying on Undici for outbound HTTP requests are also potentially vulnerable.

• nodejs / server:

  ps aux | grep undici | grep -v grep | awk '{print $6}' | xargs -n 1 pmap -x | grep -q 'total' && echo "Potential DoS vulnerability - high memory usage detected"

• nodejs / server:

  journalctl -u node -f | grep -i "oom"

• nodejs / server:

  lsof -p $(pgrep node) | grep -i 'large_response_url'

1. 2026-03-13Disclosure

   disclosure

1. आरक्षित2026-02-16
2. प्रकाशित2026-03-13
3. संशोधित2026-03-18
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2026-2581 is to upgrade to Undici version 7.24.0 or later, which includes a fix for the uncontrolled resource consumption issue. If upgrading is not immediately feasible, consider disabling the interceptors.deduplicate() feature, though this will impact the deduplication functionality. As a temporary workaround, implement rate limiting on incoming requests to reduce the number of concurrent requests processed. Monitoring memory usage within the Node.js process is also recommended to detect potential DoS attacks. After upgrading, confirm the fix by sending a series of large, identical requests and verifying that memory usage remains within acceptable limits.

अंतिम अपडेट

8.3.0हाल ही में