undici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoS

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-2581 · CVE overview and exploitation status

EUVD-2026-11705

GHSA-phc3-fgpg-7m6h

cve-program · CVE-2026-2581

• https://github.com/nodejs/undici/security/advisories/GHSA-phc3-fgpg-7m6h
• https://hackerone.com/reports/3513473
• https://cna.openjsf.org/security-advisories.html

euvd · EUVD-2026-11705

• https://github.com/nodejs/undici/security/advisories/GHSA-phc3-fgpg-7m6h
• https://hackerone.com/reports/3513473
• https://cna.openjsf.org/security-advisories.html

nvd · CVE-2026-2581

• https://cna.openjsf.org/security-advisories.html
• https://github.com/nodejs/undici/security/advisories/GHSA-phc3-fgpg-7m6h
• https://hackerone.com/reports/3513473

osv · GHSA-phc3-fgpg-7m6h

• https://github.com/nodejs/undici/security/advisories/GHSA-phc3-fgpg-7m6h
• https://nvd.nist.gov/vuln/detail/CVE-2026-2581
• https://hackerone.com/reports/3513473
• https://cna.openjsf.org/security-advisories.html
• https://github.com/nodejs/undici

• This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS). · Advisory content revised · 15 Nov 2026