CVE-2026-22036

Published: Jan 14, 2026Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0.

Affected (2)

Products: Nodejs: Undici

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Nodejs Undici	Before 6.23.0
Nodejs Undici	From 7.0.0 to 7.18.2

Related CWEs

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (2)

https://github.com/nodejs/undici/commit/b04e3cbb569c1596f86c108e9b52c79d8475dcb3

Source: security-advisories@github.com

Patch

https://github.com/nodejs/undici/security/advisories/GHSA-g9mf-h72j-4rw9

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.