CVE-2026-22036: Node.js Undici DoS Vulnerability

CVE-2026-22036 Overview

CVE-2026-22036 is a resource exhaustion vulnerability affecting Undici, a popular HTTP/1.1 client for Node.js. The vulnerability exists due to improper allocation of resources without limits (CWE-770), where the number of links in the decompression chain is unbounded. Combined with the default maxHeaderSize configuration, a malicious server can insert thousands of compression steps into the decompression chain, leading to excessive CPU usage and memory allocation, ultimately resulting in a denial of service condition.

Critical Impact

A malicious server can cause denial of service in Node.js applications using vulnerable Undici versions through unbounded decompression chain exploitation, leading to high CPU consumption and memory exhaustion.

Affected Products

• Node.js Undici versions prior to 7.18.0
• Node.js Undici versions prior to 6.23.0

Discovery Timeline

• 2026-01-14 - CVE CVE-2026-22036 published to NVD
• 2026-01-22 - Last updated in NVD database

Technical Details for CVE-2026-22036

Vulnerability Analysis

This vulnerability is classified as a Resource Exhaustion (Denial of Service) issue stemming from improper resource allocation without limits. The core problem lies in the Undici HTTP client's handling of compressed HTTP responses.

When Undici receives compressed responses (e.g., gzip, deflate, or br encoding), it processes them through a decompression chain. The vulnerability arises because there is no upper bound enforced on the number of compression layers that can be chained together. A malicious server can craft responses with an extremely deep decompression chain, containing thousands of nested compression steps.

The default maxHeaderSize configuration does not adequately protect against this attack vector, allowing malicious content-encoding headers to specify an excessive number of compression transformations. When Undici attempts to process such a response, each decompression step consumes CPU cycles and allocates memory, quickly exhausting system resources.

Root Cause

The root cause is the absence of a limit on the decompression chain depth in the HTTP response handling logic. The Undici client trusts the server-provided Content-Encoding headers without validating the total number of compression layers, allowing an attacker-controlled server to specify arbitrarily deep chains. This constitutes an improper allocation of resources without limits, as defined by CWE-770.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker needs to control or compromise a server that a vulnerable Undici client connects to. The attack flow involves:

1. The attacker sets up or compromises a server that the target application communicates with
2. When the Undici client makes an HTTP request, the malicious server responds with headers specifying thousands of compression transformations
3. The Undici client attempts to process the decompression chain sequentially
4. Each decompression step allocates memory and consumes CPU, rapidly exhausting available resources
5. The Node.js application becomes unresponsive or crashes due to memory exhaustion or CPU saturation

The vulnerability is particularly dangerous in microservices architectures where applications frequently make outbound HTTP requests to external services, as a single malicious endpoint can impact the entire application availability.

Detection Methods for CVE-2026-22036

Indicators of Compromise

• Abnormal CPU spikes in Node.js processes when making outbound HTTP requests
• Rapidly increasing memory consumption in applications using Undici
• Application hangs or timeouts when connecting to specific external endpoints
• Unusual Content-Encoding headers with multiple compression schemes in HTTP response logs

Detection Strategies

• Monitor Node.js process resource utilization for anomalous CPU or memory consumption patterns
• Implement application-level logging to track HTTP response headers, particularly Content-Encoding values
• Use dependency scanning tools to identify applications running vulnerable Undici versions (prior to 7.18.0 or 6.23.0)
• Configure network monitoring to detect responses with unusually complex Content-Encoding header chains

Monitoring Recommendations

• Set up alerts for Node.js applications exceeding baseline CPU or memory thresholds during HTTP operations
• Implement health checks that can detect application unresponsiveness related to HTTP client operations
• Review HTTP response patterns from external services for potential malicious compression configurations
• Deploy software composition analysis (SCA) tools to continuously monitor for vulnerable Undici versions across your environment

How to Mitigate CVE-2026-22036

Immediate Actions Required

• Upgrade Undici to version 7.18.0 or later for the 7.x branch
• Upgrade Undici to version 6.23.0 or later for the 6.x branch
• Audit all Node.js applications to identify those using vulnerable Undici versions
• Consider temporarily disabling automatic decompression if patching is not immediately feasible

Patch Information

The vulnerability has been addressed by the Node.js team in Undici versions 7.18.0 and 6.23.0. The fix introduces proper limits on the decompression chain depth, preventing resource exhaustion attacks. The security patch is available in the GitHub Commit Details. Additional details about the vulnerability and remediation are provided in the GitHub Security Advisory.

Organizations should prioritize updating Undici across all affected applications. The update can be applied through standard npm package management:

Workarounds

• If immediate patching is not possible, implement network-level controls to limit connections to trusted external services only
• Consider using a reverse proxy that validates and limits Content-Encoding header complexity before requests reach Node.js applications
• Implement application-level resource limits using Node.js --max-old-space-size to prevent complete system exhaustion
• Monitor and terminate requests that exceed reasonable processing time thresholds

# Update Undici to patched version (7.x branch)
npm update undici@7.18.0

# Or for 6.x branch
npm update undici@6.23.0

# Verify installed version
npm list undici