Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2026-22036
5.9
MEDIUMCVSS v3
Published
January 14, 2026
Affected
1 project
Assigned by
GitHub
Severity scale
010
Description
Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0.
nodejs/undici
GitHubAn HTTP/1.1 client, written from scratch for Node.js
GitHubAn HTTP/1.1 client, written from scratch for Node.js< 6.23.0, >= 7.0.0, < 7.18.2NVD