What is the CVSS score of EUVD-2026-11705?

EUVD-2026-11705 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Node.js are affected by EUVD-2026-11705?

Organizations using vulnerable Undici should be aware of moderate risk from CVE-2026-2581 rated CVSS 5.9. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate EUVD-2026-11705?

Within 30 days: Identify affected systems running vulnerable Undici and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Node.js EUVD-2026-11705

| CVE-2026-2581 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-03-12 ce714d77-add3-4f53-aff5-83d477b104bb

GHSA-phc3-fgpg-7m6h

Node.js Denial Of Service Undici Red Hat Suse

5.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

MEDIUM

qualitative

Red Hat

5.9 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 12, 2026 - 22:55 euvd

EUVD-2026-11705

Analysis Generated

Mar 12, 2026 - 22:55 vuln.today

CVE Published

Mar 12, 2026 - 21:16 nvd

MEDIUM 5.9

DescriptionCVE.org

This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS).

In vulnerable Undici versions, when interceptors.deduplicate() is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination.

Impacted users are applications that use Undici’s deduplication interceptor against endpoints that may produce large or long-lived response bodies.

PatchesThe issue has been patched by changing deduplication behavior to stream response chunks to downstream handlers as they arrive (instead of full-body accumulation), and by preventing late deduplication when body streaming has already started.

Users should upgrade to the first official Undici (and Node.js, where applicable) releases that include this patch.

AnalysisAI

Node.js Undici's response deduplication feature accumulates response bodies in memory instead of streaming them, allowing remote attackers to trigger denial of service through large or concurrent responses from untrusted endpoints. Applications using the deduplicate() interceptor are vulnerable to out-of-memory crashes when processing large or chunked responses. No patch is currently available.

Technical ContextAI

This vulnerability (CWE-770: Allocation of Resources Without Limits or Throttling) exists in the memory for downstream component. This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS).

Impacted users a