The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS).
In vulnerable Undici versions, when interceptors.deduplicate() is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination.
Impacted users are applications that use Undici’s deduplication interceptor against endpoints that may produce large or long-lived response bodies.
PatchesThe issue has been patched by changing deduplication behavior to stream response chunks to downstream handlers as they arrive (instead of full-body accumulation), and by preventing late deduplication when body streaming has already started.
Users should upgrade to the first official Undici (and Node.js, where applicable) releases that include this patch.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-full-i18nUpgrade v8-13.6-develUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs-develUpgrade npmUpgrade nodejs-docsUpgrade nodejs-nodemon | Apr 16, 2026 | Apr 9, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs24-develUpgrade nodejs24-full-i18nUpgrade nodejs24-docsUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-npmUpgrade nodejs24-debuginfoUpgrade v8-13.6-develUpgrade nodejs24-libsUpgrade nodejs24Upgrade nodejs24-debugsource | Apr 7, 2026 | Mar 12, 2026 |
| Oracle_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade v8-13.6-develUpgrade nodejs-develUpgrade nodejs24-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs24Upgrade nodejs24-libsUpgrade nodejs24-develUpgrade nodejs24-docsUpgrade nodejs24-npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-libsUpgrade nodejsUpgrade npm | Apr 22, 2026 | Mar 12, 2026 |
| Redhat_linux | — | Upgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs24-debugsourceUpgrade nodejs-debugsourceUpgrade nodejs-libsUpgrade nodejs-libs-debuginfoUpgrade nodejs24-develUpgrade nodejs24-full-i18nUpgrade nodejs24-libsUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs24-npmUpgrade nodejs24Upgrade nodejs-debuginfoUpgrade nodejs-packaging-bundlerNo solution existsUpgrade nodejs24-debuginfoUpgrade nodejs24-libs-debuginfoUpgrade npmUpgrade nodejs-develUpgrade v8-13.6-develUpgrade nodejs24-docsUpgrade nodejs-full-i18n | Apr 13, 2026 | Mar 12, 2026 |
| Rocky_linux | — | Upgrade nodejs-develUpgrade nodejs24-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs24-debuginfoUpgrade nodejs24-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs24-develUpgrade v8-13.6-develUpgrade nodejs-full-i18nUpgrade nodejs24-libs-debuginfoUpgrade nodejs24Upgrade nodejs24-libsUpgrade nodejs-libsUpgrade nodejs | Apr 13, 2026 | Apr 10, 2026 |
| Suse | — | Upgrade nodejs24-docsUpgrade corepack24Upgrade npm24Upgrade nodejs24Upgrade nodejs24-devel | Jun 26, 2026 | Apr 11, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub