undici vulnerable to Denial of Service via unbounded decompression of compressed responses

CVE-2026-84890 (tracked publicly as CVE-2026-22036) affects the undici HTTP client bundled with Node.js. The fetch() API honors chained Content-Encoding headers per RFC 9110 (e.g., gzip, br, gzip, …) but places no upper bound on the chain depth. A malicious HTTP server can return a response with thousands of compression layers, forcing the client to allocate a decompression stream per layer — burning CPU and RAM until the process crashes. Affected versions: undici < 6.23.0 and >= 7.0.0, < 7.18.2. Because undici ships inside Node.js core, this implicitly touches Node.js 20.x, 22.x (v6 line) and 24.x (v7 line) until patched releases landed.

The vendor-assigned MEDIUM / 5.9 is accurate. The CVSS vector flags AC:H — high attack complexity — because the attacker must *be* the HTTP server the victim application connects to (or redirect the victim via SSRF). That is a meaningful prerequisite: in most enterprise deployments, outbound HTTP targets are either allow-listed or internal. The impact ceiling is Availability only — no data leaks, no code execution, no integrity violation. A process supervisor (systemd, PM2, Kubernetes liveness probe) restarts the crashed worker in seconds. This is a real bug that deserves patching, but it is not the kind of bug that wakes up the SOC at 2 AM.

Why this verdict

• Reversed attack direction narrows exposure. Unlike a typical server-side vuln, the attacker must *be* the HTTP server. The victim app must voluntarily fetch from the malicious endpoint. This limits exploitation to apps that follow user-supplied URLs, have SSRF bugs, or process webhooks from untrusted sources — a subset of Node.js deployments.
• Availability-only impact with no escalation path. The chain ends at a process crash. There is no code execution, no data exfiltration, no lateral movement. Process managers restart workers in seconds, limiting blast duration to a transient outage.
• AC:H is real, not cosmetic. The CVSS AC:H reflects a genuine prerequisite — the attacker cannot spray this at arbitrary targets. They need the target to come to them. Enterprise egress controls (proxy allow-lists, SSRF guards) further reduce the reachable population.
• Role multiplier: undici is bundled in Node.js and runs everywhere Node runs — workstations, API servers, CI/CD runners, microservices. In CI/CD roles (GitHub Actions self-hosted runners, Jenkins agents fetching dependencies), a decompression bomb would crash the build process, causing a failed build — annoying but not supply-chain compromise (no code injection, no artifact tampering). In API gateway or webhook processor roles, it causes a transient pod restart. In no high-value role does this chain produce domain takeover, fleet compromise, mass data egress, or supply-chain pivot. The worst outcome across all roles is temporary service disruption — the blast radius stays at single-process / single-pod scope.

Why not higher?

Elevating to HIGH would require either active exploitation, a path to code execution, or a blast radius beyond a single process. None of those conditions exist. The reversed attack direction (victim must connect to attacker) means the reachable population is a fraction of Node.js deployments — those that fetch user-influenced URLs. No high-value-role scenario produces domain-scale or fleet-scale impact.

Why not lower?

Dropping to LOW would understate the risk for the subset of applications that *do* process untrusted URLs (webhook receivers, URL-preview services, SSRF-prone apps). The PoC is trivial and public, and undici's ubiquity in Node.js means the vulnerable code is present on a very large number of hosts even if most are not directly exploitable. A 5.9 MEDIUM correctly captures 'real but situational' risk.

1. Validate and allowlist outbound URLs in application code — The attack requires the victim to fetch from a malicious server. Restricting outbound fetch() targets to known-good domains eliminates the attack path entirely. Implement this as part of your standard SSRF prevention controls. No mitigation SLA applies at MEDIUM — go straight to the 365-day remediation window.
2. Apply undici interceptor to cap Content-Encoding chain depth — The advisory documents a workaround: register a custom undici interceptor that rejects responses with more than ~10 Content-Encoding tokens. This neutralizes the bug without upgrading. Useful as a stopgap if you cannot immediately bump the dependency.
3. Enforce container memory limits and liveness probes — Set Kubernetes memory limits and liveness/readiness probes so that a memory-exhaustion crash is contained to a single pod and auto-heals in seconds. This does not prevent the bug but limits blast radius to a transient restart.
4. Upgrade undici to 6.23.0+ or 7.18.2+ — The definitive fix. Run npm audit fix or pin the patched version in package.json. For Node.js core bundled undici, upgrade to the Node.js release that ships the patched version — verify with node -e 'console.log(process.versions.undici)'.

Run this on any host where Node.js applications are deployed. It checks the installed undici version in node_modules and via the Node.js built-in. Requires read access to the project directory. Example: bash check_cve_2026_84890.sh /opt/myapp

#!/usr/bin/env bash
# check_cve_2026_84890.sh — Detect undici decompression chain vulnerability
# Usage: bash check_cve_2026_84890.sh [/path/to/node/project]
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

PROJECT_DIR="${1:-.}"
RESULT="UNKNOWN"

# Helper: compare semver (returns 0 if $1 >= $2)
ver_gte() {
  printf '%s\n%s' "$2" "$1" | sort -t. -k1,1n -k2,2n -k3,3n -C 2>/dev/null
}

# Check 1: Node.js bundled undici
if command -v node &>/dev/null; then
  BUNDLED=$(node -e 'console.log(process.versions.undici || "none")' 2>/dev/null || echo "none")
  if [ "$BUNDLED" != "none" ]; then
    echo "[*] Node.js bundled undici version: $BUNDLED"
    MAJOR=$(echo "$BUNDLED" | cut -d. -f1)
    if [ "$MAJOR" -ge 7 ]; then
      if ver_gte "$BUNDLED" "7.18.2"; then
        echo "[+] Bundled undici >= 7.18.2 — PATCHED"
        RESULT="PATCHED"
      else
        echo "[-] Bundled undici < 7.18.2 — VULNERABLE"
        RESULT="VULNERABLE"
      fi
    elif [ "$MAJOR" -eq 6 ]; then
      if ver_gte "$BUNDLED" "6.23.0"; then
        echo "[+] Bundled undici >= 6.23.0 — PATCHED"
        RESULT="PATCHED"
      else
        echo "[-] Bundled undici < 6.23.0 — VULNERABLE"
        RESULT="VULNERABLE"
      fi
    else
      echo "[?] Bundled undici major version $MAJOR — not in affected range"
      RESULT="PATCHED"
    fi
  else
    echo "[*] No bundled undici reported by Node.js (older Node version)"
  fi
fi

# Check 2: npm dependency undici in project
PKG="$PROJECT_DIR/node_modules/undici/package.json"
if [ -f "$PKG" ]; then
  DEP_VER=$(grep '"version"' "$PKG" | head -1 | sed 's/[^0-9.]//g')
  echo "[*] Project undici dependency version: $DEP_VER"
  DEP_MAJOR=$(echo "$DEP_VER" | cut -d. -f1)
  if [ "$DEP_MAJOR" -ge 7 ]; then
    if ver_gte "$DEP_VER" "7.18.2"; then
      echo "[+] Dependency undici >= 7.18.2 — PATCHED"
      [ "$RESULT" != "VULNERABLE" ] && RESULT="PATCHED"
    else
      echo "[-] Dependency undici < 7.18.2 — VULNERABLE"
      RESULT="VULNERABLE"
    fi
  elif [ "$DEP_MAJOR" -eq 6 ]; then
    if ver_gte "$DEP_VER" "6.23.0"; then
      echo "[+] Dependency undici >= 6.23.0 — PATCHED"
      [ "$RESULT" != "VULNERABLE" ] && RESULT="PATCHED"
    else
      echo "[-] Dependency undici < 6.23.0 — VULNERABLE"
      RESULT="VULNERABLE"
    fi
  fi
else
  echo "[*] No undici found in $PROJECT_DIR/node_modules/"
fi

echo ""
echo "=== RESULT: $RESULT ==="
case "$RESULT" in
  PATCHED)    exit 0 ;;
  VULNERABLE) exit 1 ;;
  *)          exit 2 ;;
esac

Sources

1. GitHub Advisory — GHSA-g9mf-h72j-4rw9 (CVE-2026-22036)
2. undici Security Advisory — Unbounded Decompression Chain
3. GitLab Advisory Database — CVE-2026-22036
4. IBM Security Bulletin — Decompression Bomb in undici affecting watsonx.data
5. SentinelOne Vulnerability Database — CVE-2026-22036
6. CVEFeed — CVE-2026-22036 Detail
7. Debian Package Tracker — node-undici