CVE-2026-22036

A flaw was found in Undici, an HTTP/1.1 client for Node.js. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP response with an unbounded number of links in the decompression chain. This could lead to high CPU usage and excessive memory allocation, resulting in a Denial of Service (DoS) for the affected system.

This vulnerability is rated Low for Red Hat products. The flaw in Undici, an HTTP/1.1 client for Node.js, allows a remote malicious server to trigger a Denial of Service by sending a specially crafted HTTP response with excessive decompression steps. This can lead to high CPU usage and memory allocation on the client system. Red Hat products utilizing Undici that connect to untrusted external HTTP servers are potentially affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.