LogicalBreach Academy

Unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion | Free Bug Bounty Writeup | LogicalBreach Academy

Writeups Cheatsheets Tools Collections Authors Noc Pricing

Back

OtherCVSS 2.5Hard

Unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

hackerone-reports

March 5, 2026

1 views

Save

€0

Vulnerability Summary

HackerOne disclosed report --> https://hackerone.com/reports/3456148 by undefined

Summary:

Unbounded number of links in the decompression chain for HTTP responses in Node.js Fetch API

Description:

Fetch API supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., Content-Encoding: gzip, br). However, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation.