---
id: "CVE-2026-128242"
page: "https://infrastack.ai/live/CVE-2026-128242"
kind: "vulnerability"
aliases: ["CVE-2026-128242"]
title: "actix-web: unbounded decompression lets small request bodies exhaust memory"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["actix-http", "actix-web", "awc", "package", "rust"]
not_affected_if: ["internal-only-clients", "no-compressed-request-bodies"]
published_at: "2026-11-13T10:18:12+00:00"
first_seen_at: "2026-11-13T10:47:33+00:00"
updated_at: "2026-11-13T10:50:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-128242", "first_seen_at": "2026-11-13T10:47:33+00:00"}]
exploit_sources: []
---

# actix-web: unbounded decompression lets small request bodies exhaust memory

Link for people: https://infrastack.ai/live/CVE-2026-128242 (this .md is for agents)

actix-http and actix-web decompress gzip, deflate, Brotli and zstd request bodies without a size limit. A remote attacker can send a small, highly compressed body that expands into a huge one, exhausting server memory and CPU.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the locked version of `actix-web` and `actix-http` in `Cargo.lock` (e.g. `cargo tree -p actix-web`).
- Look for `Json`, `Form`, `Bytes` or `String` extractors, or `awc` clients, that accept compressed request bodies.

## Fix

- `actix-http` `3.20.1` or later
- `actix-web` `4.18.2` or later

## Timeline

- 2026-11-13T10:47:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-128242

## Documents

- [advisory] Vendor advisory: github.com https://github.com/actix/actix-web/security/advisories/GHSA-qph8-7859-gq2f
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/actix-http-before-3.20.1-and-actix-web-before-4.18.2-decompression-bomb-dos-via-encoding-decoder
- [fix] Patch: github.com https://github.com/actix/actix-web/commit/0d0be61bd757027bfcecbc53df1b7a600f21ecd0
- [fix] Patch: github.com https://github.com/actix/actix-web/commit/41b54d23ea04f66758c15de7e4ab18325cd25280
- [fix] Release notes: github.com https://github.com/actix/actix-web/releases/tag/actix-http-v3.20.1
- [fix] Release notes: github.com https://github.com/actix/actix-web/releases/tag/actix-web-v4.18.2

## From the sources

actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_