This vulnerability allows a malicious server to send HTTP responses that include an unbounded number of compression steps via the Content-Encoding header. The undici HTTP client, before version 7.18.0 and 6.23.0, does not limit the depth of the decompression chain and respects the default maxHeaderSize. An attacker can craft a response that triggers thousands of decompression stages, which consumes excessive CPU cycles and allocates large amounts of memory in the client process, potentially bringing the application to a halt or forcing a restart. The weakness matches CWE-770, Resource Exhaustion.

The issue impacts the Node.js Undici HTTP client. Any application built with undici version earlier than 7.18.0 (in the 7.x series) or earlier than 6.23.0 (in the 6.x series) is vulnerable. The vulnerability is known to exist on all operating systems where node.js and undici run, as the library is pure JavaScript.

The CVSS score of 5.9 indicates moderate severity, and the EPSS score of <1% shows a very low probability of exploitation in the general population. The vulnerability is not currently listed in CISA’s KEV catalog. An attacker would need to control or trick the client into connecting to a malicious server, which is a likely scenario when the client connects to external services over an insecure or partially trusted network. If exploited, the client could suffer from high CPU usage and memory exhaustion, leading to denial of service for the affected application. The absence of a known workaround means that only an update provides remediation.