{"id":"CVE-2026-22036","summary":"Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion","details":"Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0.","aliases":["GHSA-g9mf-h72j-4rw9"],"modified":"2026-05-18T05:58:31.449137453Z","published":"2026-01-14T19:07:13.745Z","related":["CGA-v3cm-92h7-q9pf","SUSE-SU-2026:0295-1","SUSE-SU-2026:0301-1","SUSE-SU-2026:0435-1","SUSE-SU-2026:0457-1","SUSE-SU-2026:20436-1","openSUSE-SU-2026:10074-1","openSUSE-SU-2026:10075-1","openSUSE-SU-2026:20236-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-770"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22036.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22036.json"},{"type":"ADVISORY","url":"https://github.com/nodejs/undici/security/advisories/GHSA-g9mf-h72j-4rw9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22036"},{"type":"FIX","url":"https://github.com/nodejs/undici/commit/b04e3cbb569c1596f86c108e9b52c79d8475dcb3"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nodejs/undici","events":[{"introduced":"1cfe0949053aac6267f11b919cee9315a27f1fd6"},{"fixed":"7e5cb2d7468633b48679627061d696a0bb45f651"}]}],"versions":["v7.18.1","v7.18.0","v7.17.0","v7.16.0","v7.15.0","v7.14.0","v7.13.0","v7.12.0","v7.11.0","v7.10.0","v7.9.0","v7.8.0","v7.7.0","v7.5.0","v7.6.0","v7.4.0","v7.3.0","v7.2.3","v7.2.2","v7.2.1","v7.2.0","v7.1.1","v7.1.0","v7.0.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-22036.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}