CVE-2026-22036: 
JavaScript vulnerability analysis and mitigation

CVE-2026-22036 is a denial-of-service vulnerability in Undici, the HTTP/1.1 client for Node.js, caused by an unbounded decompression chain in HTTP responses via the Content-Encoding header. A malicious server can craft responses with thousands of chained compression steps, leading to high CPU usage and excessive memory allocation on the client side. Affected versions are Undici < 6.23.0 and >= 7.0.0 < 7.18.2. The vulnerability was disclosed on January 14, 2026. The CNA (GitHub) assigned a CVSS v3.1 score of 5.9 (Medium), while NVD assessed it at 7.5 (High) (Github Advisory, Github Security Advisory).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): Undici's fetch() API and decompress interceptor process chained HTTP content-encoding algorithms per RFC 9110 (e.g., Content-Encoding: gzip, br) without imposing any limit on the number of decompression steps. Combined with the permissive default maxHeaderSize, a malicious server can include thousands of compression layers in a single response header, causing the client to instantiate thousands of decompressor streams. The fix, applied in commit b04e3cb, limits the Content-Encoding chain to a maximum of 5 entries — consistent with mitigations applied in urllib3 (GHSA-gm62-xv2j-4w53) and curl (CVE-2022-32206). Exploitation requires the client to connect to a server controlled or compromised by the attacker (Github Security Advisory, Patch Commit).

Successful exploitation results in a denial-of-service condition affecting the availability of any Node.js application using a vulnerable version of Undici to communicate with untrusted HTTP servers. The attack causes significant CPU exhaustion and excessive memory allocation, potentially rendering the affected application unresponsive or causing it to crash. There is no impact on confidentiality or data integrity. Downstream IBM products including watsonx.data, Maximo Application Suite, Cloud Pak for Business Automation, Business Automation Workflow, QRadar Suite Software, Security QRadar EDR, and watsonx Orchestrate are also affected as they bundle vulnerable versions of Undici (Github Advisory, IBM watsonx.data Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (7th percentile), indicating a low near-term probability of exploitation. Exploitation requires the attacker to control or compromise an HTTP server that the vulnerable Undici client connects to, raising the attack complexity.

1. Set up a malicious HTTP server: Deploy an HTTP server under attacker control that is reachable by the target Node.js application using Undici.
2. Craft a malicious response: Configure the server to respond to any HTTP request with a response containing a Content-Encoding header listing hundreds or thousands of compression algorithms (e.g., Content-Encoding: gzip, gzip, gzip, ... [repeated 1000+ times]), exploiting the permissive default maxHeaderSize.
3. Trigger the client request: Cause the vulnerable Node.js application to make an HTTP request to the malicious server — this may be achieved via SSRF, by compromising a dependency, or by operating a server the application is configured to contact (e.g., a third-party API endpoint).
4. Resource exhaustion: Upon receiving the response, Undici's decompression chain handler instantiates a decompressor for each encoding step without limit, consuming excessive CPU and memory until the application becomes unresponsive or crashes (Github Security Advisory, Patch Commit).

• Network: Outbound HTTP connections from Node.js applications to unexpected or newly observed server endpoints; HTTP responses from external servers containing abnormally long Content-Encoding headers with many comma-separated values.
• Process: Node.js process exhibiting sudden, sustained high CPU usage or rapid memory growth without a corresponding increase in legitimate traffic load; application process crashes or OOM (out-of-memory) kills.
• Logs: Application error logs showing errors referencing content-encoding or decompression failures (post-patch: too many content-encodings in response); Node.js heap dump artifacts indicating large numbers of decompressor stream objects.

Upgrade Undici to version 6.23.0 (for the 6.x branch) or 7.18.2 (for the 7.x branch), which limit the Content-Encoding chain to a maximum of 5 entries. If immediate patching is not possible, apply a custom Undici interceptor to manually filter and reject responses with excessively long Content-Encoding sequences. As an additional network-level control, restrict outbound HTTP connections from Node.js applications to known-trusted servers only. IBM has released product-specific fixes for affected products including watsonx.data, Maximo Application Suite, Cloud Pak for Business Automation, and QRadar Suite Software (Github Security Advisory, IBM watsonx.data Advisory, IBM CP4BA Advisory).

The vulnerability was reported via HackerOne (report #3456148) and disclosed by Matteo Collina (maintainer) on January 14, 2026. The fix explicitly references analogous mitigations in urllib3 and curl, framing this as a known class of decompression bomb vulnerability now addressed across major HTTP client libraries. Multiple IBM product teams issued security bulletins acknowledging the impact on their enterprise software stacks (Github Security Advisory, IBM watsonx.data Advisory).