ROOT-APP-NPM-CVE-2026-22036 CVE-2026-22036 in @rootio/undici - Patched by Root

Root has patched CVE-2026-22036 in the @rootio/undici package for Root:npm. Multiple fixed versions available...

CVE-2026-22036 vulnerabilities

Vulnerabilities for packages: librechat, kibana, langfuse, langfuse-fips, jitsucom-jitsu, renovate, code-server, gemini-cli...

CVE-2026-22036

creationtimestamp| type| source ---|---|--- 2026-01-14 20:28:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcfvtsd2pl2c 2026-01-15 08:20:31+00:00| seen| https://gist.github.com/Darkcrai86/88fd735daaf5212a2932ca1c1bdd8c2f 2026-01-24 21:24:57+00:00| seen|...

DEBIAN-CVE-2026-22036

Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This...