CVE-2026-2581: 
JavaScript vulnerability analysis and mitigation

CVE-2026-2581 is an uncontrolled resource consumption vulnerability (CWE-770) in the Undici HTTP client library's deduplication interceptor, leading to Denial of Service (DoS) via unbounded memory accumulation. It affects Undici versions >= 7.17.0 and < 7.24.0 for Node.js. The vulnerability was disclosed on March 12, 2026, by reporter 'jackhax' via HackerOne and published to the GitHub Advisory Database on March 13, 2026. It carries a CVSS v3.1 base score of 5.9 (Medium) (Github Advisory, Red Hat CVE).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling) in Undici's interceptors.deduplicate() feature. When this interceptor is enabled, response body data for deduplicated (coalesced) requests is buffered in memory in full before being forwarded to downstream handlers, rather than being streamed incrementally. An attacker who controls or can influence an upstream endpoint can serve large or chunked HTTP responses while triggering multiple concurrent identical requests from the vulnerable application, causing the process to accumulate unbounded memory. The fix changes the deduplication behavior to stream response chunks to downstream handlers as they arrive and prevents late deduplication once body streaming has already started (Github Advisory, Github Advisory).

Successful exploitation results in high memory consumption in the affected Node.js process, potentially leading to out-of-memory (OOM) errors and process termination, causing a full Denial of Service. There is no impact on confidentiality or data integrity — the vulnerability is purely an availability issue. Applications using Undici's deduplication interceptor to proxy or forward requests to untrusted or attacker-controlled upstream endpoints are most at risk, including downstream IBM products such as Cloud Pak for Integration, API Connect, QRadar Suite, and others that bundle the affected Undici versions (Github Advisory, Red Hat CVE).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of this report (Github Advisory). The vulnerability requires high attack complexity (the attacker must control or influence the upstream endpoint and coordinate concurrent identical requests), which limits opportunistic exploitation. The EPSS score is approximately 0.02% (6th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify a target application: Locate a Node.js application using Undici versions >= 7.17.0 and < 7.24.0 with interceptors.deduplicate() enabled that proxies or forwards requests to an upstream endpoint the attacker can influence or control.
2. Control or compromise the upstream endpoint: Set up or compromise an HTTP server that the vulnerable Undici client will contact, configured to return very large or indefinitely chunked HTTP response bodies (e.g., a streaming endpoint that slowly sends gigabytes of data).
3. Trigger concurrent identical requests: Send a high volume of concurrent, identical HTTP requests to the target application that will be deduplicated by Undici's interceptor (same URL, method, and headers), causing the interceptor to coalesce them and buffer the upstream response in memory for all waiting handlers.
4. Exhaust process memory: As the upstream endpoint streams a large response, the buffered data accumulates in the Node.js process heap without limit, driving memory usage to OOM levels and causing process termination or severe degradation (Github Advisory).

• Process Behavior: Rapid, sustained increase in Node.js process memory (RSS/heap) without a corresponding increase in legitimate traffic load; OOM killer events or unexpected process crashes in Node.js application logs.
• Logs: Application logs showing a spike in concurrent identical outbound HTTP requests to the same upstream endpoint; Node.js crash dumps or ENOMEM errors in system logs.
• Network: Unusually large or long-lived HTTP responses from upstream endpoints to the Node.js application; high-volume concurrent requests with identical URLs and headers arriving at the application layer.
• System: OS-level OOM events (dmesg showing oom-kill for the Node.js process); elevated swap usage or memory pressure alerts on the host running the affected application.

Upgrade Undici to version 7.24.0 or later, which patches the vulnerability by streaming response chunks instead of buffering the full body (Github Advisory). Red Hat has issued patches for RHEL 8 (RHSA-2026:7670), RHEL 9 (RHSA-2026:7350), and RHEL 10 (RHSA-2026:7675) (Red Hat Bugzilla). If immediate upgrade is not possible, the following workarounds apply: disable interceptors.deduplicate() for affected clients or routes; use skipHeaderNames with a marker header to force high-risk requests to bypass deduplication; avoid concurrent identical requests to untrusted endpoints; and apply upstream/proxy response-size and timeout limits. IBM has also released patches for affected products including Cloud Pak for Integration, API Connect, QRadar Suite, and others.