CVE-2026-22036

Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

State: Published
Severity: 5.9 Medium
Published: Jan 14, 2026
Updated: Jan 22, 2026
Reserved: Jan 5, 2026

Read the record on cve.org

Description

Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0.

Scores

CVSS	Score	Vector	Source
3.1	5.9 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H	GitHub_M

Weaknesses

CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

Product	Versions
undicinodejs	< 6.23.0Affected >= 7.0.0, < 7.18.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.