Executive brief
Undici is a JavaScript HTTP client library used in Node.js applications to fetch web content. A malicious or compromised web server can force a client to perform unlimited decompression of HTTP responses by sending an extremely long chain of compression algorithms, causing excessive CPU and memory consumption that can crash or severely slow down the application.
Technical details
The vulnerability exists in undici's HTTP decompression handling, which follows RFC 9110 to support chained Content-Encoding headers (e.g., Content-Encoding: gzip, br). The decompression chain has no upper bound on the number of links, and when combined with the default maxHeaderSize setting, an attacker can insert thousands of compression steps. This causes unbounded CPU usage and memory allocation (CWE-770: Allocation of Resources Without Limits or Throttling). The attack is network-based, requires no authentication or user interaction, but depends on the target connecting to an attacker-controlled or compromised HTTP server. Patches are available in versions 7.18.2 and 6.23.0.
Affected products
- Node.js Undici < 6.23.0; >= 7.0.0, < 7.18.2
Timeline
- 2026-01-14: disclosed
- 2026-01-14: patched: Versions 7.18.2 and 6.23.0 released