Uncontrolled Resource Consumption in Undici by Node.js

CVE-2026-2581

What is CVE-2026-2581?

This vulnerability allows attackers to exploit Undici's deduplication interceptor, leading to excessive memory consumption. When enabled, if vulnerable versions handle large or chunked responses from untrusted upstream endpoints, they can accumulate response data in memory. This can result in the application being overwhelmed and experiencing crashes due to Out of Memory (OOM) conditions. To mitigate the risk, users are advised to update to the latest Undici releases where changes to deduplication behavior ensure response chunks are streamed to downstream handlers immediately, thus preventing excessive memory usage.

References