CVE-2026-6733: undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse
Impact
Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests.
This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse.
Patches
Upgrade to undici v6.27.0, v7.28.0 or v8.5.0.
Workarounds
Disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.
Other sources
Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests.
This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse.
Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.
Workarounds: Disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 8.5.0 - Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 7.28.0 - Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 6.27.0 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 6.26.0 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 7.28.0 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 8.5.0 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 6.27.0 - Configuration
Disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.
undici Client/Pool keepAliveTimeout = 0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6733?
The severity of CVE-2026-6733 is classified as low with a CVSS score of 3.7.
How do I fix CVE-2026-6733?
To fix CVE-2026-6733, ensure to update to the latest version of the undici library where the vulnerability has been addressed.
What type of attack is associated with CVE-2026-6733?
CVE-2026-6733 is associated with HTTP response queue poisoning via keep-alive socket reuse.
What impact does CVE-2026-6733 have on applications?
The impact of CVE-2026-6733 allows an attacker to inject unsolicited HTTP responses, potentially misleading the client on reused sockets.
Is CVE-2026-6733 exploitable remotely?
Yes, CVE-2026-6733 is remotely exploitable as it involves an attacker-controlled upstream server.