Death by a Thousand Gzips: The Node.js Undici Decompression Loop
Jan 15, 2026·6 min read·6 visits
Executive Summary (TL;DR)
Undici, the engine behind Node.js's native `fetch()`, failed to limit the number of decompression steps it would perform on a response. By sending a header like `Content-Encoding: gzip, gzip, ...` repeated thousands of times, an attacker can force the client to allocate thousands of stream objects, leading to high CPU usage and eventual process crashes (DoS). The fix introduces a hard limit of 5 encoding layers.
A resource exhaustion vulnerability in the Undici HTTP client allows malicious servers to crash Node.js applications by supplying an excessive number of compression layers in the Content-Encoding header.
Official Patches
Fix Analysis (1)
Technical Appendix
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:LAffected Systems
Affected Versions Detail
| Product | Affected Versions | Fixed Version |
|---|---|---|
Undici Node.js | >= 7.0.0, < 7.18.0 | 7.18.0 |
Undici Node.js | < 6.23.0 | 6.23.0 |
| Attribute | Detail |
|---|---|
| CWE ID | CWE-770 |
| Attack Vector | Network |
| CVSS | 3.7 (Low) |
| Impact | Denial of Service (DoS) |
| Component | lib/interceptor/decompress.js |
| Limit Introduced | 5 Encodings |
MITRE ATT&CK Mapping
Allocation of Resources Without Limits or Throttling
Known Exploits & Detection
Vulnerability Timeline
Subscribe to updates
Get the latest CVE analysis reports delivered to your inbox.