Excessive Resource Consumption in Undici HTTP Client for Node.js
CVE-2026-22036

5.9MEDIUM

Key Information:

Vendor

Nodejs

Status
Undici
Vendor
CVE Published:
14 January 2026

What is CVE-2026-22036?

Undici, the HTTP/1.1 client utilized for Node.js applications, has a vulnerability that allows for excessive resource consumption due to an unbounded number of links in the decompression chain. This flaw can be exploited by a malicious server to create thousands of compression steps, leading to significant CPU strain and memory overload. This issue has been addressed in versions 7.18.0 and 6.23.0, making it crucial for users to update to these versions to mitigate potential risks.

Affected Version(s)

undici < 6.23.0 < 6.23.0

undici >= 7.0.0, < 7.18.2 < 7.0.0, 7.18.2

References

https://github.com/nodejs/undici/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/nodejs/undici/commit/b04e3cbb569c1596f...
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.