PT-2026-2950 · Node.Js · Undici

Mcollina · Published 2026-01-01 · Updated 2026-05-06 · CVE-2026-22036

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Undici versions prior to 7.18.0 Undici versions prior to 6.23.0

Description Undici is an HTTP/1.1 client for Node.js. A malicious server can insert thousands of compression steps due to an unbounded number of links in the decompression chain and the default maxHeaderSize, leading to high CPU usage and excessive memory allocation. The fetch() API supports chained HTTP encoding algorithms for response content, which is also supported by the undici decompress interceptor.

Recommendations Upgrade to version 7.18.0 or 6.23.0. As a workaround, apply an undici interceptor to filter long Content-Encoding sequences manually.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-22036

GHSA-G9MF-H72J-4RW9

OPENSUSE-SU-2026:10074-1

OPENSUSE-SU-2026:10075-1

OPENSUSE-SU-2026:20236-1

SUSE-SU-2026:0295-1

SUSE-SU-2026:0301-1

SUSE-SU-2026:0435-1

SUSE-SU-2026:0457-1

SUSE-SU-2026:20436-1

Affected Products

Undici

References · 46

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22036.json · Exploit
• https://github.com/nodejs/undici/commit/b04e3cbb569c1596f86c108e9b52c79d8475dcb3 · Patch
• https://github.com/nodejs/undici/security/advisories/GHSA-g9mf-h72j-4rw9 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-22036 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-22036 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20236-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-22036 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0301-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-22036 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0295-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20436-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0435-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0457-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22036 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10075-1 · Vendor Advisory