5.9
Moyenne
CVE-2026-22036 Undici is an HTTP/1.1 client for Node.js
Description
Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0.
Produits et versions touchés
Autres CVE de undici
Les 15 CVE de undici →
CVE-2025-47279
Undici is an HTTP/1.1 client for Node.js
3.1
Faible
CVE-2025-22150
Undici is an HTTP/1.1 client
6.8
Moyenne
CVE-2024-38372
Undici is an HTTP/1.1 client, written from scratch for Node.js
2.0
Faible
CVE-2024-30260
Undici is an HTTP/1.1 client, written from scratch for Node.js
3.9
Faible