CVE-2026-6733: Undici HTTP Client Queue Poisoning Flaw

CVE-2026-6733 Overview

CVE-2026-6733 affects Undici, the HTTP/1.1 client used by Node.js. The vulnerability allows response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream HTTP/1.1 server can inject an unsolicited response onto an idle socket after a request completes. When the client dispatches the next request on the same socket, Undici associates the injected response with the new request. This causes responses to be delivered to the wrong requests, breaking request-response correlation.

Exploitation requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse. The flaw is tracked under [CWE-367] (Time-of-Check Time-of-Use race condition).

Critical Impact
Mismatched HTTP responses can deliver sensitive data to unintended request contexts, enabling information leakage and integrity issues between concurrent client requests.

Affected Products

Undici versions prior to v6.26.0 (6.x branch)
Undici versions prior to v7.28.0 (7.x branch)
Undici versions prior to v8.5.0 (8.x branch)

Discovery Timeline

2026-06-17 - CVE-2026-6733 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-6733

Vulnerability Analysis

Undici maintains a pool of keep-alive HTTP/1.1 sockets for performance. After a request completes, the socket returns to an idle state and waits for the next request. The vulnerability arises when an upstream server writes an unsolicited HTTP/1.1 response onto that idle socket before the client dispatches a new request.

When Undici sends the next request over the reused socket, its response parser reads the pre-injected bytes and treats them as the response to the new request. The legitimate response to the new request, if any, becomes orphaned or is associated with a subsequent request. This breaks the one-to-one mapping between requests and responses on a persistent connection.

The consequence is response queue poisoning. Data intended for one request can be returned to another, including responses containing authentication tokens, user-specific data, or cached content. Applications relying on Undici for service-to-service HTTP calls may receive incorrect data without any parser-level error.

Root Cause

The root cause is a race condition [CWE-367] between socket idle-state checks and the arrival of unsolicited server data. Undici does not validate that the socket buffer is empty before reusing the connection for a new request. The HTTP/1.1 client trusts that the upstream server will only send response bytes in reply to a dispatched request.

Attack Vector

The attack requires the client to communicate with an attacker-controlled or compromised HTTP/1.1 origin server. The attacker writes a crafted HTTP/1.1 response to an idle keep-alive socket immediately after a legitimate request completes. The next request the Undici client dispatches on that socket inherits the injected response. Exploitation complexity is high because the attacker must control upstream behavior and time the injection against socket reuse. See the GitHub Security Advisory GHSA-35p6-xmwp-9g52 and HackerOne Report #3582376 for additional technical detail.

Detection Methods for CVE-2026-6733

Indicators of Compromise

Application logs showing HTTP responses with content that does not match the request URL, method, or expected schema.
Unexpected Content-Length or Transfer-Encoding mismatches on reused keep-alive connections to specific upstream hosts.
Cross-tenant or cross-user data appearing in responses for unrelated requests in multi-tenant Node.js services.

Detection Strategies

Inventory Node.js applications and dependent packages to identify Undici versions below v6.26.0, v7.28.0, or v8.5.0.
Inspect outbound HTTP/1.1 traffic to untrusted upstream services for unsolicited server-initiated bytes on idle sockets.
Add application-level correlation IDs and validate that response payloads correspond to the originating request context.

Monitoring Recommendations

Monitor process-level dependency manifests (package.json, package-lock.json) in CI pipelines for vulnerable Undici versions.
Alert on anomalous upstream response patterns such as responses arriving on sockets with no pending request.
Track outbound connections to third-party HTTP/1.1 endpoints that are not under direct organizational control.

How to Mitigate CVE-2026-6733

Immediate Actions Required

Upgrade Undici to v6.26.0, v7.28.0, or v8.5.0 depending on the major version in use.
Audit transitive dependencies, as frameworks such as fetch in Node.js and many HTTP client libraries embed Undici.
Restrict outbound HTTP/1.1 calls to trusted upstream services where feasible.

Patch Information

The Undici maintainers released fixed versions v6.26.0, v7.28.0, and v8.5.0. Refer to the GitHub Security Advisory GHSA-35p6-xmwp-9g52 and the OpenJSF Security Advisories for release notes and patch commits.

Workarounds

Disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Undici Client or Pool instance.
Prefer HTTP/2 upstream endpoints, which are not affected by HTTP/1.1 response queue semantics.
Isolate calls to untrusted upstream servers behind a vetted reverse proxy that validates response framing.

bash

# Configuration example: disable keep-alive reuse in Undici
node -e "const { Pool } = require('undici'); const pool = new Pool('https://upstream.example.com', { keepAliveTimeout: 0 });"