← Vulnerability feed

Vulnerability record · CVE-2026-22036 · published 14 January 2026

CVE-2026-22036: Nodejs undici allocation without limits vulnerability

Nodejs · Undici

Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0.

7.5 CVSS 3.1 High EPSS 0.46% · top 62.4% CWE-770 · Allocation without limits
7.5CVSS 3.1 base score
0.46%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/nodejs/undici/commit/b04e3cbb569c1596f86c108e9b52c79d8475dcb3 Patch
https://github.com/nodejs/undici/security/advisories/GHSA-g9mf-h72j-4rw9 Vendor Advisory

Track CVE-2026-22036 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-1525Nodejs undici http request smuggling vulnerabilityUndici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-leng…EPSS 0.49%9.8CVE-2022-35949Nodejs undici server-side request forgery (ssrf) vulnerabilityundici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes…EPSS 1.8%9.1CVE-2026-84961Nodejs undici improper certificate validation vulnerabilityundici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Bec…EPSS 0.25%9.1CVE-2026-13697Nodejs undici information exposure vulnerabilityundici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a…EPSS 0.57%8.8CVE-2026-6734Nodejs undici origin validation error vulnerabilityImpact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches…EPSS 0.39%8.2CVE-2026-84933Nodejs undici information exposure vulnerabilityundici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that …EPSS 0.34%7.5CVE-2026-19534Nodejs undici unchecked return value vulnerabilityundici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client ne…EPSS 0.39%7.5CVE-2026-85014Nodejs undici vulnerabilityundici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close…EPSS 0.54%

Source: NIST National Vulnerability Database (record CVE-2026-22036), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.