CVE-2026-22036

MediumDDoS

Published: 14 January 2026

Published

14 January 2026

Modified

22 January 2026

KEV Added

—

Patch

—

CVSS Score v3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score 0.0002 6.9th percentile

Risk Priority 12 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-22036 is a medium-severity Allocation of Resources Without Limits or Throttling (CWE-770) vulnerability in Nodejs Undici. Its CVSS base score is 5.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 6.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-22036 affects Undici, an HTTP/1.1 client library for Node.js, in versions prior to 7.18.0 and 6.23.0. The vulnerability stems from an unbounded number of links in the decompression chain combined with a default maxHeaderSize that permits a malicious server to insert thousands of compression steps. This results in high CPU usage and excessive memory allocation, classified under CWE-770 (Allocation of Resources Without Limits or Throttling) with a CVSS v3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).

A remote attacker with no privileges or user interaction required can exploit this over the network, though it demands high attack complexity. By controlling a server that a victim application connects to via Undici, the attacker crafts HTTP responses with deeply nested compression layers, triggering resource exhaustion on the client side and causing denial-of-service through CPU and memory overload.

The Undici security advisory (GHSA-g9mf-h72j-4rw9) and associated commit (b04e3cbb569c1596f86c108e9b52c79d8475dcb3) confirm the issue is resolved in versions 7.18.0 and 6.23.0, recommending immediate upgrades for affected Node.js applications using Undici.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-2422

Vulnerability details

Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage…

and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0.

CWE(s): CWE-770

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

attack.mitre.org →

Why these techniques?

Vulnerability enables client-side resource exhaustion DoS via malicious HTTP response with nested compression, directly matching application exploitation for endpoint denial of service.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1