- Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch A... CVE-2026-22036

CVE ID : CVE-2026-22036 Published : Jan. 14, 2026, 7:16 p.m. | 28 minutes ago Description : Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0. Severity: 3.7 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Source: Telegram CVE Monitor