CVE-2026-2581 Overview
CVE-2026-2581 is an uncontrolled resource consumption vulnerability (CWE-770) in Undici, a fast HTTP/1.1 client for Node.js, that can lead to Denial of Service (DoS) conditions. When the interceptors.deduplicate() feature is enabled, response data for deduplicated requests is accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this behavior by sending large or chunked responses while triggering concurrent identical requests, resulting in excessive memory consumption and potential Out-of-Memory (OOM) process termination.
Critical Impact
Applications using Undici's deduplication interceptor against untrusted endpoints may experience memory exhaustion and service disruption when processing large or long-lived response bodies.
Affected Products
- Undici HTTP client (vulnerable versions with interceptors.deduplicate() functionality)
- Node.js applications utilizing Undici's deduplication interceptor
- Applications communicating with untrusted upstream endpoints using request deduplication
Discovery Timeline
- 2026-03-12 - CVE CVE-2026-2581 published to NVD
- 2026-03-12 - Last updated in NVD database
Technical Details for CVE-2026-2581
Vulnerability Analysis
This vulnerability affects the request deduplication interceptor in Undici. The deduplication feature is designed to prevent redundant outbound requests by consolidating identical concurrent requests and sharing the response data among them. However, the original implementation accumulated the entire response body in memory before distributing it to downstream handlers.
When an attacker controls or influences an upstream endpoint, they can exploit this memory accumulation behavior by returning exceptionally large responses or implementing chunked transfer encoding with long-lived connections. Combined with concurrent identical requests from the application, this causes the memory footprint to grow uncontrollably as response data buffers expand.
The vulnerability is particularly dangerous in scenarios where applications communicate with external or user-influenced endpoints while using the deduplication feature to optimize performance. The memory consumption scales with both response size and the number of deduplicated requests, creating conditions for rapid memory exhaustion.
Root Cause
The root cause lies in Undici's original deduplication implementation which performed full-body accumulation of response data before forwarding to downstream handlers. This design decision meant that large responses had to be fully buffered in memory, creating a resource consumption vulnerability when processing oversized or maliciously crafted responses.
Additionally, the implementation allowed late deduplication to occur even after body streaming had already started, compounding the memory accumulation issue across multiple concurrent request handlers.
Attack Vector
The attack vector is network-based, requiring an attacker to control or influence an upstream endpoint that the vulnerable application communicates with using Undici's deduplication interceptor. The attack can be executed by:
- Identifying applications that use interceptors.deduplicate() against external endpoints
- Causing the target application to make multiple concurrent identical requests to an attacker-controlled endpoint
- Responding with extremely large payloads or implementing slow chunked responses that keep connections open while accumulating data
- The response data accumulates in memory across all deduplicated request handlers, potentially exhausting available memory and causing OOM termination
The attack complexity is considered high as it requires specific conditions: the deduplication interceptor must be enabled, the target must make concurrent identical requests, and the attacker must have influence over the upstream response content.
Detection Methods for CVE-2026-2581
Indicators of Compromise
- Abnormal memory growth in Node.js processes utilizing Undici HTTP client
- Unusually large response bodies from upstream endpoints during concurrent request patterns
- Process termination events caused by Out-of-Memory conditions
- Increased response times correlating with memory pressure during deduplication operations
Detection Strategies
- Monitor Node.js process memory metrics for gradual or sudden increases during HTTP client operations
- Implement logging for Undici deduplication interceptor usage and response sizes
- Configure heap memory thresholds and alerts for applications using request deduplication
- Review application code for interceptors.deduplicate() usage against untrusted or external endpoints
Monitoring Recommendations
- Set up memory usage alerting thresholds for Node.js application processes
- Monitor upstream endpoint response sizes and duration for anomalous patterns
- Implement circuit breakers to limit memory exposure from long-running HTTP operations
- Enable garbage collection monitoring to detect memory pressure from buffered response data
How to Mitigate CVE-2026-2581
Immediate Actions Required
- Upgrade Undici to the latest patched version that includes streaming deduplication behavior
- Review application code for usage of interceptors.deduplicate() against untrusted endpoints
- Consider temporarily disabling the deduplication interceptor if patches cannot be applied immediately
- Implement response size limits at the application level for requests to external endpoints
Patch Information
The vulnerability has been patched by modifying the deduplication behavior to stream response chunks to downstream handlers as they arrive, rather than accumulating the full response body in memory. The fix also prevents late deduplication when body streaming has already commenced, eliminating the memory accumulation condition.
Users should upgrade to the first official Undici releases (and Node.js distributions where applicable) that include this security patch. Refer to the GitHub Advisory GHSA-phc3-fgpg-7m6h for specific version information.
Additional resources:
Workarounds
- Disable the interceptors.deduplicate() feature until patches can be applied
- Implement upstream response size limits using reverse proxies or middleware
- Avoid using deduplication interceptor for requests to untrusted or external endpoints
- Configure Node.js memory limits (--max-old-space-size) to prevent complete system exhaustion while accepting potential service restarts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
