Listen to this Post
The vulnerability exploits the fetch() API in Node.js via the undici library, which handles HTTP response decompression according to RFC 9110. When a server sends a response with a Content-Encoding header containing multiple algorithms (e.g., “gzip, br, gzip”), the undici decompress interceptor processes each encoding step in sequence. However, there is no enforced limit on the number of steps in this decompression chain. A malicious server can craft a response with thousands of encoding entries, such as repeating “gzip” numerous times. Each decompression step requires CPU cycles and memory allocation for the interim data. As the chain unwinds, the cumulative resource demand escalates exponentially due to recursive decompression calls. The default maxHeaderSize setting permits long header values, facilitating this attack. This leads to high CPU usage and excessive memory consumption, causing resource exhaustion. The Node.js process may become unresponsive or crash, resulting in denial of service. Applications using fetch() to retrieve data from untrusted URLs are particularly at risk. The flaw resides in the interceptor’s lack of bounds checking during decompression iteration. Patches introduce a cap on decompression steps to mitigate the issue.
Platform: Undici on Node.js
Version: Before 7.18.2
Vulnerability: Unbounded decompression chain
Severity: Low
Date: Jan 14 2026
Prediction: Patched in 7.18.2
What Undercode Say:
Analytics:
bash commands:
npm list undici
curl -H “Content-Encoding: gzip,br,gzip” http://example.com
node -e “import(‘undici’).then(m => console.log(m.version))”
codes:
const response = await fetch(‘http://malicious-server.com’);
const data = await response.text();
// Vulnerable to decompression chain attack
const { createInterceptor } = require(‘undici’);
// Interceptor to filter long Content-Encoding
how Exploit:
Craft HTTP response with repetitive Content-Encoding values like “gzip, gzip, gzip…” to trigger unbounded decompression chain, exhausting CPU and memory.
Protection from this CVE:
Upgrade undici to 7.18.2 or apply custom interceptor to limit Content-Encoding steps.
Impact:
Resource exhaustion leading to denial of service.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
