CVE-2026-22036CWE-770

Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

Medium · published January 14, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
38.6
In the wild
Unconfirmed
What it is

Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00457 · 38.6th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-01-14T19:07Z
EPSS history
Timeline
  • 14 JAN 19:07Z
    Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion
    cvelistv5