Aller au contenu
en Se connecter
5.9 Moyenne

CVE-2026-22036 Undici is an HTTP/1.1 client for Node.js

Description

Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0.

Produits et versions touchés

Produit Versions touchées Corrigé en
undici 7.0 7.0.0 → < 7.18.2 7.18.2
undici 6.23 premières → < 6.23.0 6.23.0

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de undici

Les 15 CVE de undici →
CVE-2025-47279 Undici is an HTTP/1.1 client for Node.js 3.1 Faible CVE-2025-22150 Undici is an HTTP/1.1 client 6.8 Moyenne CVE-2024-38372 Undici is an HTTP/1.1 client, written from scratch for Node.js 2.0 Faible CVE-2024-30260 Undici is an HTTP/1.1 client, written from scratch for Node.js 3.9 Faible
Suivre cette CVE