CVE-2026-22036 is a vulnerability classified under CWE-770 (Allocation of Resources Without Limits or Throttling) found in the undici HTTP/1.1 client library for Node.js. The issue exists in undici versions prior to 6.23.0 and between 7.0.0 and 7.18.2, where the decompression chain length is unbounded when processing HTTP responses. Specifically, the default maxHeaderSize setting allows a malicious HTTP server to craft responses with thousands of compression steps, causing the client to allocate excessive memory and consume high CPU resources during decompression. This leads to a denial-of-service (DoS) condition by exhausting system resources. The vulnerability does not impact confidentiality or integrity but severely affects availability. Exploitation requires no authentication or user interaction and can be triggered remotely by connecting to a malicious or compromised HTTP server. The vulnerability was publicly disclosed on January 14, 2026, with a CVSS v3.1 base score of 5.9 (medium severity), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability. The issue is resolved in undici versions 6.23.0 and 7.18.2 by introducing limits on the decompression chain length and improving resource management during decompression.

For European organizations, this vulnerability poses a risk primarily to availability of services that rely on Node.js applications using vulnerable undici versions for HTTP client functionality. Organizations that consume HTTP responses from external or untrusted servers—such as API clients, microservices, or proxy services—may experience service outages or degraded performance due to resource exhaustion. This can disrupt business operations, impact customer-facing services, and potentially cause cascading failures in distributed systems. The vulnerability does not expose sensitive data or allow unauthorized code execution, but denial of service can have significant operational and reputational consequences. Sectors with high reliance on Node.js for web services, including finance, telecommunications, and e-commerce, may be particularly impacted. Additionally, cloud and hosting providers running Node.js workloads could see increased incident response costs and service level agreement (SLA) violations if exploited.

The primary mitigation is to upgrade undici to version 6.23.0 or later, or 7.18.2 or later, where the vulnerability is fixed. Organizations should audit their Node.js dependencies to identify and remediate vulnerable undici versions promptly. In addition, implement network-level protections such as firewall rules or proxy filtering to restrict connections to trusted HTTP servers and block suspicious or untrusted endpoints that could serve malicious responses. Employ runtime monitoring and resource usage alerts to detect abnormal CPU or memory consumption in Node.js processes. Consider configuring Node.js application-level timeouts and limits on response sizes to reduce impact. For environments where immediate upgrade is not feasible, isolating vulnerable services in containers or sandboxes with resource limits can help contain potential DoS effects. Regularly review and update dependency management practices to prevent introduction of vulnerable versions in the future.