This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS).
In vulnerable Undici versions, when interceptors.deduplicate() is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination.
Impacted users are applications that use Undici’s deduplication interceptor against endpoints that may produce large or long-lived response bodies.
PatchesThe issue has been patched by changing deduplication behavior to stream response chunks to downstream handlers as they arrive (instead of full-body accumulation), and by preventing late deduplication when body streaming has already started.
Users should upgrade to the first official Undici (and Node.js, where applicable) releases that include this patch.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade v8-13.6-develUpgrade nodejs-libsUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade npm | Apr 16, 2026 | Apr 9, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs24-libs-debuginfoUpgrade nodejs24-debuginfoUpgrade nodejs24-develUpgrade nodejs24-npmUpgrade v8-13.6-develUpgrade nodejs24-full-i18nUpgrade nodejs24-docsUpgrade nodejs24Upgrade nodejs24-debugsourceUpgrade nodejs24-libs | Apr 7, 2026 | Mar 12, 2026 |
| Oracle_linux | — | Upgrade nodejs-libsUpgrade nodejs24-npmUpgrade npmUpgrade nodejs24-docsUpgrade nodejs24-develUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs24-libsUpgrade nodejs24-full-i18nUpgrade nodejs-nodemonUpgrade v8-13.6-develUpgrade nodejs24Upgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-docs | Apr 22, 2026 | Mar 12, 2026 |
| Redhat_linux | — | Upgrade npmUpgrade nodejs-debuginfoUpgrade nodejs24-libsUpgrade nodejsUpgrade nodejs24-npmUpgrade nodejs24Upgrade nodejs24-develUpgrade nodejs24-libs-debuginfoNo solution existsUpgrade nodejs-packaging-bundlerUpgrade nodejs24-full-i18nUpgrade nodejs24-debuginfoUpgrade nodejs-packagingUpgrade nodejs24-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade nodejs24-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade v8-13.6-develUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-docs | Apr 13, 2026 | Mar 12, 2026 |
| Rocky_linux | — | Upgrade nodejs24Upgrade nodejsUpgrade v8-13.6-develUpgrade nodejs24-libsUpgrade nodejs-libsUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-develUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs24-debugsourceUpgrade nodejs24-debuginfoUpgrade nodejs-develUpgrade nodejs24-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfo | Apr 13, 2026 | Apr 10, 2026 |
| Suse | — | Upgrade nodejs24-docsUpgrade corepack24Upgrade npm24Upgrade nodejs24-develUpgrade nodejs24 | Jun 26, 2026 | Apr 11, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub