StackRadar

CVE-2026-22036

High

Advisory

Published 14 Jan 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.005
40th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
78
of 17,781 indexed, latest versions
Container images
72
deployed by those charts
Fix available
1 of 2
affected packages

Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

Carried by container images the latest versions of 78 of 17,781 indexed charts deploy, on 72 images.

Affected packageAffected versionsFixed inImages
node-undicideb5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1, 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3, 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4, 5.26.3+dfsg1+~cs23.10.12-2+1 moreno fix listed9
undicinpm4.15.0, 5.6.0, 5.11.0, 5.12.0+27 more6.23.0, 7.18.272
OSV records
DEBIAN-CVE-2026-22036GHSA-g9mf-h72j-4rw9UBUNTU-CVE-2026-22036

Charts affected

78 by stars
ChartLatestAffected imagesRadar Score
stacks-blockchain-apihirosystemsVerified publisher6.5.11 of 5See more

stacks-blockchain-api hirosystems 6.5.1

1 of the 5 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
hirosystems/stacks-blockchain-api:8.13.29c98b23c1515
undici@6.21.2
6.23.0

Open the chart page →

8,364
budibasebudibase0.0.0-master1 of 7See more

budibase budibase 0.0.0-master

1 of the 7 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
budibase/apps:3.41.344fe6feab985
undici@6.21.3
6.23.0

Open the chart page →

10,775
n8nn8n0.23.01 of 1See more

n8n n8n 0.23.0

1 of the 1 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
n8nio/n8n:1.33.1dd171d45102a
undici@6.9.0
6.23.0

Open the chart page →

5,639
syftopenmined0.9.51 of 6See more

syft openmined 0.9.5

1 of the 6 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
openmined/syft-frontend:0.9.5d11524a3854a
undici@6.11.1
6.23.0

Open the chart page →

17,245
foundry-vttfoundry-vttVerified publisher12.343.01 of 1See more

foundry-vtt foundry-vtt 12.343.0

1 of the 1 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
felddy/foundryvtt:12.343.06c5e3e9ffbb0
undici@6.19.7
6.23.0

Open the chart page →

723
openhabhelmforgeVerified publisher1.2.01 of 1See more

openhab helmforge 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
openhab/openhab:5.2.1bfd4a60e90da
node-undici@7.3.0+dfsg1+~cs24.12.11-1
undici@7.3.0
no fix listed
7.18.2

Open the chart page →

3,641
headplanenbcloudVerified publisher0.1.21 of 4See more

headplane nbcloud 0.1.2

1 of the 4 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
ghcr.io/tale/headplane:0.5.50dbc52cffc19
undici@6.21.0
6.23.0

Open the chart page →

7,949
cosmocosmo-platformOfficialVerified publisher0.20.01 of 10See more

cosmo cosmo-platform 0.20.0

1 of the 10 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/controlplane:0.133.149800ff775f3
undici@5.28.4
6.23.0

Open the chart page →

28,839
graphql-hivegraphql-hive1.0.01 of 17See more

graphql-hive graphql-hive 1.0.0

1 of the 17 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
undici@5.12.0
6.23.0

Open the chart page →

10,311
globalpingglobalpingVerified publisher1.0.111 of 1See more

globalping globalping 1.0.11

1 of the 1 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
globalping/globalping-probe:latest8acbd23009fd
undici@5.29.0
6.23.0

Open the chart page →

518
kenerkenerVerified publisher0.2.01 of 1See more

kener kener 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
undici@6.21.1
6.23.0

Open the chart page →

5,228
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
langgenius/dify-api:0.6.11fca918260dd6
node-undici@5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3
undici@5.15.0
no fix listed
6.23.0

Open the chart page →

20,403
openvaultopenvaultVerified publisher0.8.11 of 2See more

openvault openvault 0.8.1

1 of the 2 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
undici@6.21.2
6.23.0

Open the chart page →

6,873
uptime-kumapascaliskeVerified publisher3.0.01 of 1See more

uptime-kuma pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.2-slim-rootless9865163f92c1
undici@6.22.0
6.23.0

Open the chart page →

6,883
jellyseerrrtomik-helm-chartsVerified publisher0.0.11 of 1See more

jellyseerr rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
undici@7.3.0
7.18.2

Open the chart page →

2,823
uptime-kumasb-helm-charts0.4.01 of 1See more

uptime-kuma sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.24c364ef96aad
undici@6.22.0
6.23.0

Open the chart page →

38,107
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
undici@6.21.3
6.23.0

Open the chart page →

5,213
speckle-serverspeckleVerified publisher2.26.31 of 4See more

speckle-server speckle 2.26.3

1 of the 4 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
speckle/speckle-server:2.26.379f14a2bf931
undici@5.29.0
6.23.0

Open the chart page →

10,380
youtubedl-materialyoutubedl-materialVerified publisher0.0.11 of 1See more

youtubedl-material youtubedl-material 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
tzahi12345/youtubedl-material:latest2f943d584711
undici@5.22.0
6.23.0

Open the chart page →

9,783
akto-source-code-analyserakto0.1.51 of 3See more

akto-source-code-analyser akto 0.1.5

1 of the 3 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
aktosecurity/akto-puppeteer-replay:doom_latest853e37321e6e
undici@5.28.3
6.23.0

Open the chart page →

4,880
astrotrekastria0.0.21 of 4See more

astrotrek astria 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
undici@5.28.3
6.23.0

Open the chart page →

32,501
ghostchart-ghost0.1.51 of 2See more

ghost chart-ghost 0.1.5

1 of the 2 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
library/ghost:6.22.0-alpine3.23ac533a6988ee
undici@5.22.1
6.23.0

Open the chart page →

4,083
arbitrumchronicleVerified publisher0.3.41 of 1See more

arbitrum chronicle 0.3.4

1 of the 1 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
offchainlabs/nitro-node:v3.7.6-c0fe95e9f779fa84b7b
node-undici@5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4
undici@5.15.0
no fix listed
6.23.0

Open the chart page →

6,998
cloudpremcloudprem0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad3 of 6See more

cloudprem cloudprem 0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad

3 of the 6 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
undici@6.21.0
6.23.0
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
undici@6.21.3
6.23.0
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
undici@6.21.3
6.23.0

Open the chart page →

18,293
codehubcodehubVerified publisher6.2.181 of 5See more

codehub codehub 6.2.18

1 of the 5 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
jupyterhub/jupyterhub:5.4.63974ba945e65
node-undici@5.26.3+dfsg1+~cs23.10.12-2
undici@5.26.3
no fix listed
6.23.0

Open the chart page →

13,220
dev-code-servercosmoVerified publisher0.0.71 of 2See more

dev-code-server cosmo 0.0.7

1 of the 2 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
ghcr.io/cosmo-workspace/dev-code-server:v0.0.316fda01ae58a
undici@6.21.2
6.23.0

Open the chart page →

14,559
authfcryptexlabsVerified publisher0.12.131 of 4See more

authf cryptexlabs 0.12.13

1 of the 4 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
cryptexlabs/authf:0.12.11189c07411d7c
undici@6.19.8
6.23.0

Open the chart page →

3,769
cspconsolecspconsole1.3.111 of 5See more

cspconsole cspconsole 1.3.11

1 of the 5 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
cspconsole/report-processor:1.0.279a2d8840bfdf
undici@5.29.0
6.23.0

Open the chart page →

12,274
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
node-undici@5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4
undici@5.15.0
no fix listed
6.23.0

Open the chart page →

19,224
directusdirectusVerified publisher0.9.101 of 4See more

directus directus 0.9.10

1 of the 4 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
directus/directus:11.1.0e3c8bb975350
undici@6.19.5
6.23.0

Open the chart page →

4,551
dominodomino-iisasVerified publisher0.3.11 of 3See more

domino domino-iisas 0.3.1

1 of the 3 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
ghcr.io/iisas/domino-frontend:k8s8e53861be292
node-undici@5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4
undici@5.15.0
no fix listed
6.23.0

Open the chart page →

10,270
dumpstoredumpstore0.1.11 of 2See more

dumpstore dumpstore 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
ghcr.io/manzil-infinity180/backend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b496c90cf82fdd
undici@7.11.0
7.18.2

Open the chart page →

4,251
arbitrumdysnixVerified publisher0.1.11 of 1See more

arbitrum dysnix 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
offchainlabs/nitro-node:v3.1.0-7d1d84ce95865866129
node-undici@5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4
undici@5.15.0
no fix listed
6.23.0

Open the chart page →

9,244
bee-localchainethersphereVerified publisher0.2.01 of 1See more

bee-localchain ethersphere 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
ethersphere/bee-localchain:latest0558799ca992
undici@5.28.3
6.23.0

Open the chart page →

2,266
geth-swapethersphereVerified publisher0.6.31 of 2See more

geth-swap ethersphere 0.6.3

1 of the 2 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
ethersphere/bee-localchain:latest0558799ca992
undici@5.28.3
6.23.0

Open the chart page →

4,756
evobotevobotVerified publisher0.1.11 of 1See more

evobot evobot 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
ghcr.io/drewburr-labs/evobot:3.0.04ddbb244c82f
undici@5.27.2
6.23.0

Open the chart page →

2,987
consent-managerfiware0.1.21 of 1See more

consent-manager fiware 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
quay.io/wi_stefan/consent-manager:0.0.656399619568b
undici@5.29.0
6.23.0

Open the chart page →

1,847
scanservjsgabe565Verified publisher0.9.21 of 1See more

scanservjs gabe565 0.9.2

1 of the 1 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
sbs20/scanservjs:release-v3.0.3dad1fd6e9a98
node-undici@5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1
undici@5.15.0
no fix listed
6.23.0

Open the chart page →

13,241
ghostghostVerified publisher0.1.01 of 4See more

ghost ghost 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
library/ghost:5.79.083f7bf209844
undici@5.22.1
6.23.0

Open the chart page →

9,019
hive-appgraphql-hive1.0.01 of 1See more

hive-app graphql-hive 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
undici@5.12.0
6.23.0

Open the chart page →

2,682
hive-appgraphql-hive-subcharts1.0.01 of 1See more

hive-app graphql-hive-subcharts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
undici@5.12.0
6.23.0

Open the chart page →

2,682
dtlinfradao0.0.11 of 1See more

dtl infradao 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
undici@4.15.0
6.23.0

Open the chart page →

4,944
deconzjanip81-helm-chartsVerified publisher0.1.11 of 1See more

deconz janip81-helm-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
deconzcommunity/deconz:2.29.2062de2362641
node-undici@5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4
undici@5.15.0
no fix listed
6.23.0

Open the chart page →

10,780
n8njanip81-helm-chartsVerified publisher0.1.41 of 1See more

n8n janip81-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
n8nio/n8n:1.86.08b39ed5a2de9
undici@5.28.5
6.23.0

Open the chart page →

5,826
youtubedl-materialk8s-home-lab-repo5.1.11 of 1See more

youtubedl-material k8s-home-lab-repo 5.1.1

1 of the 1 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
tzahi12345/youtubedl-material:4.3.22f943d584711
undici@5.22.0
6.23.0

Open the chart page →

9,783
kenerkener-chart0.0.71 of 1See more

kener kener-chart 0.0.7

1 of the 1 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
undici@6.21.1
6.23.0

Open the chart page →

5,228
component-storekubebb0.0.231 of 1See more

component-store kubebb 0.0.23

1 of the 1 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
kubebb/component-store:latestfd8ecbd73213
undici@5.22.1
6.23.0

Open the chart page →

2,178
jellyseerrlbenicio-communityVerified publisher0.1.01 of 1See more

jellyseerr lbenicio-community 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:latest4538137bc5af
undici@7.3.0
7.18.2

Open the chart page →

3,555
bofmojaloop5.1.61 of 1See more

bof mojaloop 5.1.6

1 of the 1 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
mojaloop/security-role-perm-operator-svc:v3.0.212af60892c75
undici@7.16.0
7.18.2

Open the chart page →

2,457
finance-portalmojaloop5.1.42 of 11See more

finance-portal mojaloop 5.1.4

2 of the 11 container images this version deploys carry CVE-2026-22036.

Container imageDigestPackageFixed in
mojaloop/reporting-events-processor-svc:v3.5.11e0d24d28512
undici@7.11.0
7.18.2
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
undici@7.10.0
7.18.2

Open the chart page →

14,809

Container images carrying it

72 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
speckle/speckle-server:2.20.6-branch.testing1.154030-9b09114e8413f57b327
undici@5.28.4
6.23.0
1
veecode/devportalc443520aebf7
undici@5.29.0
6.23.0
1
vividplanet/swr-cache-proxy:v1ae1c5b1cbecb
undici@5.24.0
6.23.0
1
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
undici@5.28.3
6.23.0
1
ghcr.io/cosmo-workspace/dev-code-server:v0.0.316fda01ae58a
undici@6.21.2
6.23.0
1
ghcr.io/drewburr-labs/evobot:3.0.04ddbb244c82f
undici@5.27.2
6.23.0
1
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
undici@7.3.0
7.18.2
1
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
undici@6.21.0
6.23.0
1
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
undici@6.21.3
6.23.0
1
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
undici@6.21.3
6.23.0
1
ghcr.io/iisas/domino-frontend:k8s8e53861be292
node-undici@5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4
undici@5.15.0
no fix listed
6.23.0
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
undici@6.21.3
6.23.0
1
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
undici@6.21.3
6.23.0
1
ghcr.io/manzil-infinity180/backend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b496c90cf82fdd
undici@7.11.0
7.18.2
1
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
undici@6.21.1
6.23.0
1
ghcr.io/tale/headplane:0.5.50dbc52cffc19
undici@6.21.0
6.23.0
1
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
undici@6.21.2
6.23.0
1
ghcr.io/woodenmaiden/relfinderreformedapi:1.1.20708d30433d4
undici@5.28.2
6.23.0
1
ghcr.io/wundergraph/cosmo/controlplane:0.133.149800ff775f3
undici@5.28.4
6.23.0
1
public.ecr.aws/aws-containers/retail-store-sample-checkout:1.3.0687aa68dd490
undici@7.12.0
7.18.2
1
quay.io/soketi/k8soketi:0.1-18-debian4cd9ea9434c4
undici@5.11.0
6.23.0
1
quay.io/wi_stefan/consent-manager:0.0.656399619568b
undici@5.29.0
6.23.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.