CVE-2026-6733 Details
Description
Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests. This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: Disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.
A response queue poisoning vulnerability has been identified in Undici's HTTP/1.1 client, affecting versions prior to 6.26.0, 7.0.0 through 7.28.0, and 8.0.0 through 8.5.0. The vulnerability arises when keep-alive sockets are reused, allowing an attacker-controlled upstream server to inject unsolicited HTTP/1.1 responses onto idle sockets after a request has been completed. This injected response is then incorrectly associated with the next request dispatched on that socket, leading to responses being delivered to the wrong requests. Exploitation requires an attacker-controlled or compromised upstream HTTP/1.1 server and the reuse of keep-alive connections.
Users can upgrade to Undici versions 6.26.0, 7.28.0, or 8.5.0. Alternatively, keep-alive connection reuse can be disabled by setting keepAliveTimeout to 0 on the Client or Pool.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.openjsf.org/security-advisories.html | openjs | Vendor Advisory |
| https://github.com/nodejs/undici/security/advisories/GHSA-35p6-xmwp-9g52 | openjs | MitigationVendor Advisory |
| https://hackerone.com/reports/3582376 | openjs | Issue Tracking |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | openjs |
Affected Products
| Product | Versions |
|---|---|
| nodejs undici | < 6.27.0 >= 7.0.0, < 7.28.0 >= 8.0.0, < 8.5.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 27, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | New CVE Received | openjs |