Undici, the HTTP client library used by many Node.js applications, has a flaw that allows uncontrolled memory consumption when its deduplication interceptor is enabled. The vulnerability causes response data for identical requests to be buffered in memory rather than streamed to downstream handlers, resulting in unbounded growth in memory usage. If an attacker can control or influence a upstream endpoint to return large or chunked responses and multiple identical requests are sent concurrently, the process will exhaust available memory, potentially leading to an out‑of‑memory (OOM) error and a denial of service. The underlying weakness is identified as an unbounded unchecked resource consumption (CWE‑770, CWE‑400).

Systems affected are Node.js applications that depend on the Undici package with its deduplication interceptor enabled. The vulnerability is present in older undici releases prior to the first official patched release. Exact version ranges are not specified in the advisory, but any installation of Undici that has the interceptor enabled and has not applied the patch is susceptible.

Risk assessment classifies the issue with a CVSS score of 5.9, indicating a medium severity. The EPSS score of less than 1% suggests that exploitation is currently uncommon or unlikely. The vulnerability is not listed in the CISA KEV catalog, implying it is not a known exploited vulnerability. Exploitation requires the application to receive large or chunked responses from an upstream service and simultaneously process several identical requests, meaning the exploitation vector is remote, likely over HTTP or HTTPS, and depends on the application’s network exposure. While the conditions are specific, the impact on memory limits makes the exploit potentially effective for attackers who can trigger the conditions.