CVE-2026-22036: Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion
Impact
The fetch() API supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., Content-Encoding: gzip, br). This is also supported by the undici decompress interceptor.
However, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation.
Patches
Upgrade to 7.18.2 or 6.23.0.
Workarounds
It is possible to apply an undici interceptor and filter long Content-Encoding sequences manually.
References
https://hackerone.com/reports/3456148 https://github.com/advisories/GHSA-gm62-xv2j-4w53 https://curl.se/docs/CVE-2022-32206.html
Other sources
Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22036?
CVE-2026-22036 has a high severity rating due to its potential for resource exhaustion through an unbounded decompression chain.
How do I fix CVE-2026-22036?
To fix CVE-2026-22036, upgrade Undici to version 7.18.0 or later, or 6.23.0 or later.
What causes CVE-2026-22036?
CVE-2026-22036 is caused by an unbounded decompression chain in HTTP responses resulting from the Node.js Fetch API's handling of Content-Encoding.
Which versions of Undici are affected by CVE-2026-22036?
Versions of Undici prior to 7.18.0 and 6.23.0 are affected by CVE-2026-22036.
What is the potential impact of CVE-2026-22036?
The potential impact of CVE-2026-22036 includes significant resource exhaustion leading to denial of service.