What’s Vulnerable › Vulnerabilities

CVE-2026-22036: Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-14 · updated 2026-06-17
• Weakness: CWE-770

Description

Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0.

Affected products

• undici: before 6.23.0; from 7.0.0 before 7.18.2 — fixed in 6.23.0, 7.18.2
• Npm Undici: from 7.0.0 before 7.18.2; before 6.23.0 — fixed in 7.18.2, 6.23.0

How to fix

Upgrade to a fixed version: undici 6.23.0, 7.18.2; Npm Undici 7.18.2, 6.23.0. Check the vendor advisory for mitigations.

References

• https://github.com/nodejs/undici/commit/b04e3cbb569c1596f86c108e9b52c79d8475dcb3
• https://github.com/nodejs/undici/security/advisories/GHSA-g9mf-h72j-4rw9

Get alerted when CVE-2026-22036 or the next vulnerability affects your stack