CVE-2026-6733
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk14th percentile — higher than 14% of all known CVEs
Summary
Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket, causing responses to be delivered to the wrong requests.
Risk Assessment
An attacker can swap server responses, leading to data integrity violations and potential information leakage between client requests.
Recommendation
Upgrade undici to version 6.26.0, 7.28.0, or 8.5.0. As a workaround, disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.
Original NVD description (English source)
Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests. This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: Disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.