{"action":"Upgrade undici to 6.23.0 or later.","affected":[{"fixed":"7.18.2","introduced":"7.0.0"},{"fixed":"6.23.0","introduced":"0"}],"component":"undici","cve_ids":["CVE-2026-22036"],"ecosystem":"npm","epss":0.00457,"exploited":false,"fixed_versions":["7.18.2","6.23.0"],"ghsa_id":"GHSA-g9mf-h72j-4rw9","id":"tcs_01M5KFR74JC4JXYV95JMH2VA2J","modified_at":"2026-09-10T03:50:33.216915457Z","published_at":"2026-01-14T21:06:08Z","references":["https://osv.dev/vulnerability/GHSA-g9mf-h72j-4rw9","https://github.com/nodejs/undici/security/advisories/GHSA-g9mf-h72j-4rw9","https://nvd.nist.gov/vuln/detail/CVE-2026-22036","https://github.com/nodejs/undici/commit/b04e3cbb569c1596f86c108e9b52c79d8475dcb3","https://github.com/nodejs/undici"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-g9mf-h72j-4rw9","url":"https://osv.dev/vulnerability/GHSA-g9mf-h72j-4rw9"}],"summary":"Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion"}