Unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

OtherCVSS 2.5€0

HackerOne

Disclosed on HackerOne · February 23, 2026

4 min 11

Save

Publicly disclosed report

View original on HackerOne

Summary:

Unbounded number of links in the decompression chain for HTTP responses in Node.js Fetch API

Description:

Fetch API supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., Content-Encoding: gzip, br). However, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation.

Steps To Reproduce:

Identification Required

You must be logged in to read this writeup. Join our community of researchers today.

Sign In Register

LogicalBreach Academy

Unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

Steps To Reproduce:

Identification Required

Discussion