CVE-2026-6733: Undici HTTP/1.1 Response Queue Poisoning Vulnerability

Technical summary

The vulnerability is a response queue poisoning issue in Undici's HTTP/1.1 implementation. When keep-alive is enabled, Undici reuses TCP sockets across multiple requests. An attacker-controlled upstream server can inject a crafted HTTP/1.1 response onto an idle socket after the client's request completes but before the socket is reused. Due to improper request-response association logic, the injected response gets queued and associated with the next request dispatched on that socket, causing response mismatch. This occurs at the protocol handling layer where responses should be strictly matched to their corresponding requests via sequence or state management.

Business impact

Applications using Undici to communicate with untrusted or potentially compromised upstream servers face data integrity risks. An attacker could cause the application to receive and act on incorrect response data—for example, receiving a server error response intended for another request, cached malicious data, or attacker-controlled content. The impact depends on how the application handles response mismatches and whether it includes sensitive data. For services that proxy, cache, or relay responses, this could lead to data corruption or cross-contamination between requests.

Affected systems

Undici versions prior to v6.26.0, v7.28.0, and v8.5.0 are vulnerable. Any Node.js application using an affected version of Undici with keep-alive enabled (the default) and making requests to an upstream HTTP/1.1 server is in scope. This includes applications using higher-level libraries that depend on Undici, such as certain versions of fetch polyfills or Node.js native fetch implementations.

Exploitability

Exploitation requires an attacker to control or compromise the upstream HTTP/1.1 server that the vulnerable client connects to. The attacker cannot remotely exploit a client without first gaining access to the server layer. The CVSS score of 3.7 (LOW) reflects this high prerequisite—network access alone is insufficient. Once the upstream is compromised, exploitation is deterministic: the attacker can reliably inject responses on keep-alive sockets.

Remediation

Upgrade Undici to v6.26.0, v7.28.0, or v8.5.0 or later depending on your current version line. If immediate patching is not feasible, disable keep-alive connection reuse by setting keepAliveTimeout: 0 when instantiating the Client or Pool. This mitigation eliminates socket reuse and prevents the queue poisoning condition, though it incurs a performance penalty due to increased connection overhead.

Patch guidance

Determine which version of Undici your application uses by checking package.json and package-lock.json or yarn.lock. For v6.x users, upgrade to v6.26.0 or later; for v7.x, upgrade to v7.28.0 or later; for v8.x, upgrade to v8.5.0 or later. Test the patched version in a staging environment to ensure compatibility with your request patterns. If Undici is a transitive dependency (pulled in by another package), update the parent package to a version that depends on the patched Undici release.

Detection guidance

Monitor your application logs and error metrics for signs of response mismatches: requests receiving unexpected response codes, content-type mismatches, or malformed response bodies that don't align with the request. If you have observability around request-response correlation, look for cases where response metadata (headers, status) does not match the outgoing request. Network-level detection is difficult without upstream server compromise visibility; the attack is silent at the transport layer. If you control the upstream servers, audit access logs and server state for signs of compromise or unexpected response injection.

Why prioritize this

Despite the LOW CVSS score, this vulnerability warrants prompt patching because it undermines HTTP protocol correctness and data integrity. Applications that rely on accurate request-response matching for security or functionality (e.g., proxies, gateways, or services handling sensitive data) face direct risk. The mitigation (disabling keep-alive) is straightforward but costly to performance, so patching is preferable. Prioritize systems where the upstream server is not fully trusted or where response tampering could impact downstream users.

Risk score, explained

The CVSS 3.1 score of 3.7 is driven by low complexity (AC:H reflects the need for upstream compromise), network-only attack vector, and limited impact (integrity only, no confidentiality or availability loss on the client itself). However, the score does not account for the indirect impact on data integrity across the application layer, which may be significant depending on use case. Organizations handling sensitive data or relying on response authenticity should treat this as higher priority than the score alone suggests.

Frequently asked questions