REDHAT-BUG-2490006: Low severity npm/undici vulnerability
Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests.
This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse.
Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.
Workarounds: Disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 6.26.0 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 7.28.0 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 8.5.0 - Configuration
Disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.
Undici HTTP client keepAliveTimeout = 0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2490006?
The severity of REDHAT-BUG-2490006 is classified as low.
What is the impact of REDHAT-BUG-2490006?
The impact of REDHAT-BUG-2490006 is that it allows for response queue poisoning on reused keep-alive sockets.
How do I fix REDHAT-BUG-2490006?
To fix REDHAT-BUG-2490006, update the npm/undici package to a patched version.
Who can be affected by REDHAT-BUG-2490006?
Users of the npm/undici HTTP/1.1 client who utilize keep-alive sockets can be affected by REDHAT-BUG-2490006.
What type of attack is associated with REDHAT-BUG-2490006?
REDHAT-BUG-2490006 is associated with response queue poisoning attacks.