Vulnerability-Lookup

CVE-2026-2581 (GCVE-0-2026-2581)

Vulnerability from cvelistv5 – Published: 2026-03-12 20:13 – Updated: 2026-03-13 18:04

Title

undici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoS

Summary

This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS). In vulnerable Undici versions, when interceptors.deduplicate() is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination. Impacted users are applications that use Undici’s deduplication interceptor against endpoints that may produce large or long-lived response bodies. PatchesThe issue has been patched by changing deduplication behavior to stream response chunks to downstream handlers as they arrive (instead of full-body accumulation), and by preventing late deduplication when body streaming has already started. Users should upgrade to the first official Undici (and Node.js, where applicable) releases that include this patch.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-13 18:04 UTC

CWE

CWE-770 - Allocation of resources without limits or throttling

Assigner

openjs CNA under the redhat root

CNA scorecard C 66/100 over 142 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/nodejs/undici/security/advisor…
https://hackerone.com/reports/3513473
https://cna.openjsf.org/security-advisories.html

Impacted products

1 product

Vendor	Product	Version	CPE status
undici	undici	Affected: < 6.24.0; 7.0.0 < 7.24.0 Unaffected: 6.24.0: 7.24.0	guessed

Credits

Matteo Collina Ulises Gascón Adnan Jakati

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-2581",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-13T18:04:49.981133Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-13T18:04:58.799Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/nodejs/undici/",
          "defaultStatus": "unaffected",
          "packageName": "undici",
          "product": "undici",
          "repo": "https://github.com/nodejs/undici/",
          "vendor": "undici",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.24.0; 7.0.0 \u003c 7.24.0"
            },
            {
              "status": "unaffected",
              "version": "6.24.0: 7.24.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Matteo Collina"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Ulises Gasc\u00f3n"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Adnan Jakati"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThis is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS).\u003c/p\u003e\u003cp\u003eIn vulnerable Undici versions, when\u0026nbsp;\u003ccode\u003einterceptors.deduplicate()\u003c/code\u003e\u0026nbsp;is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination.\u003c/p\u003e\u003cp\u003eImpacted users are applications that use Undici\u2019s deduplication interceptor against endpoints that may produce large or long-lived response bodies.\u003c/p\u003e\u003ch2\u003ePatches\u003c/h2\u003e\u003cp\u003eThe issue has been patched by changing deduplication behavior to stream response chunks to downstream handlers as they arrive (instead of full-body accumulation), and by preventing late deduplication when body streaming has already started.\u003c/p\u003e\u003cp\u003eUsers should upgrade to the first official Undici (and Node.js, where applicable) releases that include this patch.\u003c/p\u003e\u003cp\u003e\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS).\n\nIn vulnerable Undici versions, when\u00a0interceptors.deduplicate()\u00a0is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination.\n\nImpacted users are applications that use Undici\u2019s deduplication interceptor against endpoints that may produce large or long-lived response bodies.\n\nPatchesThe issue has been patched by changing deduplication behavior to stream response chunks to downstream handlers as they arrive (instead of full-body accumulation), and by preventing late deduplication when body streaming has already started.\n\nUsers should upgrade to the first official Undici (and Node.js, where applicable) releases that include this patch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of resources without limits or throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-12T20:13:19.571Z",
        "orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "shortName": "openjs"
      },
      "references": [
        {
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-phc3-fgpg-7m6h"
        },
        {
          "url": "https://hackerone.com/reports/3513473"
        },
        {
          "url": "https://cna.openjsf.org/security-advisories.html"
        }
      ],
      "source": {
        "advisory": "GHSA-phc3-fgpg-7m6h",
        "discovery": "EXTERNAL"
      },
      "title": "undici is vulnerable to Unbounded Memory Consumption in in Undici\u0027s DeduplicationHandler via Response Buffering leads to DoS",
      "x_generator": {
        "engine": "Vulnogram 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
    "assignerShortName": "openjs",
    "cveId": "CVE-2026-2581",
    "datePublished": "2026-03-12T20:13:19.571Z",
    "dateReserved": "2026-02-16T12:07:35.310Z",
    "dateUpdated": "2026-03-13T18:04:58.799Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-2581",
      "date": "2026-11-14",
      "epss": "0.0063",
      "percentile": "0.50781"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://github.com/nodejs/undici/",
                "defaultStatus": "unaffected",
                "packageName": "undici",
                "product": "undici",
                "repo": "https://github.com/nodejs/undici/",
                "vendor": "undici",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 6.24.0; 7.0.0 \u003c 7.24.0"
                  },
                  {
                    "status": "unaffected",
                    "version": "6.24.0: 7.24.0"
                  }
                ]
              }
            ],
            "source": "ce714d77-add3-4f53-aff5-83d477b104bb"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*",
                    "matchCriteriaId": "F59DFD47-C8E0-425D-86EA-D9B0496EA2B6",
                    "versionEndExcluding": "7.24.0",
                    "versionStartIncluding": "7.17.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS).\n\nIn vulnerable Undici versions, when\u00a0interceptors.deduplicate()\u00a0is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination.\n\nImpacted users are applications that use Undici\u2019s deduplication interceptor against endpoints that may produce large or long-lived response bodies.\n\nPatchesThe issue has been patched by changing deduplication behavior to stream response chunks to downstream handlers as they arrive (instead of full-body accumulation), and by preventing late deduplication when body streaming has already started.\n\nUsers should upgrade to the first official Undici (and Node.js, where applicable) releases that include this patch."
          },
          {
            "lang": "es",
            "value": "Esta es una vulnerabilidad de consumo de recursos no controlado (CWE-400) que puede conducir a una denegaci\u00f3n de servicio (DoS).\n\nEn versiones vulnerables de Undici, cuando interceptors.deduplicate() est\u00e1 habilitado, los datos de respuesta para solicitudes deduplicadas podr\u00edan acumularse en la memoria para los manejadores posteriores. Un endpoint ascendente controlado por un atacante o no confiable puede explotar esto con respuestas grandes/en fragmentos y solicitudes id\u00e9nticas concurrentes, causando un alto uso de memoria y una posible terminaci\u00f3n del proceso por OOM.\n\nLos usuarios afectados son aplicaciones que utilizan el interceptor de deduplicaci\u00f3n de Undici contra endpoints que pueden producir cuerpos de respuesta grandes o de larga duraci\u00f3n.\n\nParches. El problema ha sido parcheado cambiando el comportamiento de deduplicaci\u00f3n para transmitir fragmentos de respuesta a los manejadores posteriores a medida que llegan (en lugar de la acumulaci\u00f3n del cuerpo completo), y evitando la deduplicaci\u00f3n tard\u00eda cuando la transmisi\u00f3n del cuerpo ya ha comenzado.\n\nLos usuarios deber\u00edan actualizar a las primeras versiones oficiales de Undici (y Node.js, cuando corresponda) que incluyan este parche."
          }
        ],
        "id": "CVE-2026-2581",
        "lastModified": "2026-06-17T10:31:21.140",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 5.9,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 3.6,
              "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-2581",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-13T18:04:49.981133Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-03-12T21:16:25.930",
        "references": [
          {
            "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://cna.openjsf.org/security-advisories.html"
          },
          {
            "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
            "tags": [
              "Mitigation",
              "Vendor Advisory"
            ],
            "url": "https://github.com/nodejs/undici/security/advisories/GHSA-phc3-fgpg-7m6h"
          },
          {
            "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
            "tags": [
              "Permissions Required"
            ],
            "url": "https://hackerone.com/reports/3513473"
          }
        ],
        "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-770"
              }
            ],
            "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-11-05T19:32:14+00:00",
      "cve": "CVE-2026-2581",
      "id": "CVE-2026-2581",
      "initial_release_date": "2026-03-12T20:13:19.571000+00:00",
      "product_status:fixed": "111",
      "product_status:known_affected": "53",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "undici: Undici: Denial of Service due to uncontrolled resource consumption",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2581.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-2581",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-03-13T18:04:49.981133Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-03-13T18:04:54.993Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://github.com/nodejs/undici/",
              "defaultStatus": "unaffected",
              "packageName": "undici",
              "product": "undici",
              "repo": "https://github.com/nodejs/undici/",
              "vendor": "undici",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 6.24.0; 7.0.0 \u003c 7.24.0"
                },
                {
                  "status": "unaffected",
                  "version": "6.24.0: 7.24.0"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Matteo Collina"
            },
            {
              "lang": "en",
              "type": "remediation reviewer",
              "value": "Ulises Gasc\u00f3n"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Adnan Jakati"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eThis is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS).\u003c/p\u003e\u003cp\u003eIn vulnerable Undici versions, when\u0026nbsp;\u003ccode\u003einterceptors.deduplicate()\u003c/code\u003e\u0026nbsp;is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination.\u003c/p\u003e\u003cp\u003eImpacted users are applications that use Undici\u2019s deduplication interceptor against endpoints that may produce large or long-lived response bodies.\u003c/p\u003e\u003ch2\u003ePatches\u003c/h2\u003e\u003cp\u003eThe issue has been patched by changing deduplication behavior to stream response chunks to downstream handlers as they arrive (instead of full-body accumulation), and by preventing late deduplication when body streaming has already started.\u003c/p\u003e\u003cp\u003eUsers should upgrade to the first official Undici (and Node.js, where applicable) releases that include this patch.\u003c/p\u003e\u003cp\u003e\u003cbr\u003e\u003c/p\u003e"
                }
              ],
              "value": "This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS).\n\nIn vulnerable Undici versions, when\u00a0interceptors.deduplicate()\u00a0is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination.\n\nImpacted users are applications that use Undici\u2019s deduplication interceptor against endpoints that may produce large or long-lived response bodies.\n\nPatchesThe issue has been patched by changing deduplication behavior to stream response chunks to downstream handlers as they arrive (instead of full-body accumulation), and by preventing late deduplication when body streaming has already started.\n\nUsers should upgrade to the first official Undici (and Node.js, where applicable) releases that include this patch."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 5.9,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-770",
                  "description": "CWE-770 Allocation of resources without limits or throttling",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-03-12T20:13:19.571Z",
            "orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
            "shortName": "openjs"
          },
          "references": [
            {
              "url": "https://github.com/nodejs/undici/security/advisories/GHSA-phc3-fgpg-7m6h"
            },
            {
              "url": "https://hackerone.com/reports/3513473"
            },
            {
              "url": "https://cna.openjsf.org/security-advisories.html"
            }
          ],
          "source": {
            "advisory": "GHSA-phc3-fgpg-7m6h",
            "discovery": "EXTERNAL"
          },
          "title": "undici is vulnerable to Unbounded Memory Consumption in in Undici\u0027s DeduplicationHandler via Response Buffering leads to DoS",
          "x_generator": {
            "engine": "Vulnogram 1.0.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "assignerShortName": "openjs",
        "cveId": "CVE-2026-2581",
        "datePublished": "2026-03-12T20:13:19.571Z",
        "dateReserved": "2026-02-16T12:07:35.310Z",
        "dateUpdated": "2026-03-13T18:04:58.799Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

SUSE-SU-2026:22565-1

Vulnerability from csaf_suse - Published: 2026-07-06 20:22 - Updated: 2026-11-13 11:01

Summary

Security update for nodejs24

Severity

Important

Scope

21 vulnerabilities in this advisory, including CVE-2026-2581.

CVE-2026-2581

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Recommended: 34 products

Open the full advisory

UBUNTU-CVE-2026-2581 (CVE-2026-2581)

Vulnerability from osv_ubuntu – Published: 2026-03-12 21:16 – Updated: 2026-10-17 09:37 – Source website

Details

Severity

5.9 (Medium)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-2581	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-2581	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-llhttp",
            "binary_version": "9.1.3~5.26.3+dfsg1+~cs23.10.12-2"
          },
          {
            "binary_name": "node-undici",
            "binary_version": "5.26.3+dfsg1+~cs23.10.12-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "node-undici",
        "purl": "pkg:deb/ubuntu/node-undici@5.26.3+dfsg1+~cs23.10.12-2?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.22.1+dfsg1+~cs20.10.10.2-1ubuntu1",
        "5.26.3+dfsg1+~cs23.10.12-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libllhttp9.2",
            "binary_version": "9.2.1~7.3.0+dfsg1+~cs24.12.11-2"
          },
          {
            "binary_name": "node-llhttp",
            "binary_version": "9.2.1~7.3.0+dfsg1+~cs24.12.11-2"
          },
          {
            "binary_name": "node-undici",
            "binary_version": "7.3.0+dfsg1+~cs24.12.11-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "node-undici",
        "purl": "pkg:deb/ubuntu/node-undici@7.3.0+dfsg1+~cs24.12.11-2?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.3.0+dfsg1+~cs24.12.11-1",
        "7.3.0+dfsg1+~cs24.12.11-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-undici",
            "binary_version": "8.9.0+dfsg+~cs3.2.0-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.10",
        "name": "node-undici",
        "purl": "pkg:deb/ubuntu/node-undici@8.9.0+dfsg+~cs3.2.0-1?arch=source\u0026distro=stonking"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.18.2+dfsg+~cs3.2.0-1build1",
        "7.24.6+dfsg+~cs3.2.0-3",
        "8.5.0+dfsg+~cs3.2.0-2",
        "8.5.0+dfsg+~cs3.2.0-3",
        "8.9.0+dfsg+~cs3.2.0-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-undici",
            "binary_version": "7.18.2+dfsg+~cs3.2.0-1build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "node-undici",
        "purl": "pkg:deb/ubuntu/node-undici@7.18.2+dfsg+~cs3.2.0-1build1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.3.0+dfsg1+~cs24.12.11-2",
        "7.16.0+dfsg+~cs3.2.0-2",
        "7.18.2+dfsg+~cs3.2.0-1",
        "7.18.2+dfsg+~cs3.2.0-1build1"
      ]
    }
  ],
  "aliases": [],
  "details": "This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS). In vulnerable Undici versions, when\u00a0interceptors.deduplicate()\u00a0is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination. Impacted users are applications that use Undici\u2019s deduplication interceptor against endpoints that may produce large or long-lived response bodies. PatchesThe issue has been patched by changing deduplication behavior to stream response chunks to downstream handlers as they arrive (instead of full-body accumulation), and by preventing late deduplication when body streaming has already started. Users should upgrade to the first official Undici (and Node.js, where applicable) releases that include this patch.",
  "id": "UBUNTU-CVE-2026-2581",
  "modified": "2026-10-17T09:37:48Z",
  "published": "2026-03-12T21:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-2581"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2581"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-2581"
  ]
}

WID-SEC-W-2026-0933

Vulnerability from csaf_certbund - Published: 2026-03-30 22:00 - Updated: 2026-05-31 22:00

Summary

IBM App Connect Enterprise (Hono und Undici): Mehrere Schwachstellen

Severity

Hoch

Scope

9 vulnerabilities in this advisory, including CVE-2026-2581.

CVE-2026-2581

Known affected: 5 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-2581 (GCVE-0-2026-2581)

SUSE-SU-2026:22565-1

UBUNTU-CVE-2026-2581 (CVE-2026-2581)

WID-SEC-W-2026-0933

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour