CVE catalog
CVE-2026-2581
This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS). In vulnerable Undici versions, when interceptors.deduplicate() is enabled, response data
- Severity
- Medium · CVSS 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.58% · Oct 25, 2026
This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS). In vulnerable Undici versions, when interceptors.deduplicate() is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination. Impacted users are applications that use Undici’s deduplication interceptor against endpoints that may produce large or long-lived response bodies. PatchesThe issue has been patched by changing deduplication behavior to stream response chunks to downstream handlers as they arrive (instead of full-body accumulation), and by preventing late deduplication when body streaming has already started. Users should upgrade to the first official Undici (and Node.js, where applicable) releases that include this patch.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | node-undici | sid | 8.12.2+dfsg+~cs3.2.3-2 | fixed |
| Debian | node-undici | forky | 8.10.2+dfsg+~cs3.2.2-1 | fixed |
| Debian | node-undici | trixie | 7.3.0+dfsg1+~cs24.12.11-1 | vulnerable |
| Debian | node-undici | bookworm | 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4 | not affected |
| Debian | node-undici | bookworm-security | 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3 | not affected |
| Npm | undici | Not reported | 7.24.0 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | node-undici | source | sid | 7.24.5+dfsg+~cs3.2.0-1 | not yet assigned | Not reported | [1130885] |
| Debian | node-undici | source | forky | 7.24.5+dfsg+~cs3.2.0-1 | not yet assigned | Not reported | [1130885] |
| Debian | node-undici | source | trixie | (unfixed) | not yet assigned | Not reported | [1130885] |
| Debian | node-undici | source | bookworm | Not affected | unimportant | Not reported | [1130885] |
| Npm | undici | npm | Not reported | 7.24.0 | Not reported | Not reported | Not reported |
Notes
[trixie] node-undici: Minor issue
OpenFactory catalog packages
[Debian 13 (Trixie)]
- [libllhttp9.2]Affected
Source package: [node-undici]
Details (2)
9.2.1~7.3.0+dfsg1+~cs24.12.11-1· amd64 · trixieAffected
nvd · node-undici · debian · 13
9.2.1~7.3.0+dfsg1+~cs24.12.11-1· arm64 · trixieAffected
nvd · node-undici · debian · 13
- [libllhttp-dev]Affected
Source package: [node-undici]
Details (2)
9.2.1~7.3.0+dfsg1+~cs24.12.11-1· amd64 · trixieAffected
nvd · node-undici · debian · 13
9.2.1~7.3.0+dfsg1+~cs24.12.11-1· arm64 · trixieAffected
nvd · node-undici · debian · 13
- [node-llhttp]Affected
Source package: [node-undici]
Details (2)
9.2.1~7.3.0+dfsg1+~cs24.12.11-1· all · trixieAffected
nvd · node-undici · debian · 13
9.2.1~7.3.0+dfsg1+~cs24.12.11-1· all · trixieAffected
nvd · node-undici · debian · 13
- [node-undici]Affected
Details (2)
7.3.0+dfsg1+~cs24.12.11-1· all · trixieAffected
nvd · node-undici · debian · 13
7.3.0+dfsg1+~cs24.12.11-1· all · trixieAffected
nvd · node-undici · debian · 13
[Debian 12 (Bookworm)]
- [node-llhttp]Not affected
Source package: [node-undici]
Details (4)
8.1.0~5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4· all · bookwormNot affected
nvd · node-undici · debian · bookworm
8.1.0~5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4· all · bookwormNot affected
nvd · node-undici · debian · bookworm
8.1.0~5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3· all · bookworm-securityNot affected
nvd · node-undici · debian · bookworm
8.1.0~5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3· all · bookworm-securityNot affected
nvd · node-undici · debian · bookworm
- [node-undici]Not affected
Details (4)
5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4· all · bookwormNot affected
nvd · node-undici · debian · bookworm
5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4· all · bookwormNot affected
nvd · node-undici · debian · bookworm
5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3· all · bookworm-securityNot affected
nvd · node-undici · debian · bookworm
5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3· all · bookworm-securityNot affected
nvd · node-undici · debian · bookworm
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22565-1.json]
- [https://github.com/advisories/GHSA-phc3-fgpg-7m6h]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-2581]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-2581]
- [https://security-tracker.debian.org/tracker/CVE-2026-2581]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2581.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0933.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]