CVE-2026-22036

🗓️ 14 Jan 2026 19:16:47Reported by [email protected]Type

Unbounded decompression links in Undici before versions 7.18 and 6.23 cause high CPU usage.

Reporter	Title	Published	Views	Family All 100
IBM Security Bulletins	Security Bulletin: IBM Automation Decision Services for June 2026- Multiple CVEs addressed	14 Jul 202606:59	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Undici affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	4 May 202614:26	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions	31 Mar 202612:18	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Undici affects IBM watsonx Orchestrate with watsonx Assistant Cartridge	23 Mar 202619:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge	18 May 202606:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to high CPU usage and excessive memory allocation (CVE-2026-22036)	1 Sep 202614:34	–	ibm
IBM Security Bulletins	Security Bulletin: Decompression Bomb Vulnerability in Undic, affects watsonx.data	10 Apr 202605:33	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in undici bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage	13 Jul 202619:40	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of NodeJS, IBM Cloud Pak System is affected by multiple vulnerabilities	13 Jul 202621:32	–	ibm
ATTACKERKB	CVE-2026-22036	14 Jan 202619:07	–	attackerkb

NVD

Node

nodejs undiciRange<6.23.0node.js

nodejs undiciRange7.0.0–7.18.2node.js

Source	Link
github	www.github.com/nodejs/undici/commit/b04e3cbb569c1596f86c108e9b52c79d8475dcb3
github	www.github.com/nodejs/undici/security/advisories/GHSA-g9mf-h72j-4rw9

17 Jun 2026 10:19Current

CVSS 3.15.9 - 7.5

EPSS0.0044