Junglewise Threat Intelligence

CVE-2026-6733: Node.js undici HTTP response queue poisoning via keep-alive socket reuse

CVE-2026-6733 · Severity: low · CVSS 3.7 · Published 2026-06-17

Vendors: Nodejs.

Executive brief

Undici is a popular HTTP client library used in Node.js applications to communicate with upstream servers. A flaw in its keep-alive connection handling allows a compromised upstream server to inject fake responses that get associated with the wrong requests. An attacker with control of a backend server could use this to intercept responses meant for one client request and send them to another, potentially exposing data or causing application malfunction.

Technical details

The vulnerability is a time-of-check time-of-use (TOCTOU) race condition (CWE-367) in undici's HTTP/1.1 client socket reuse logic. When a keep-alive socket is idle, an attacker-controlled upstream server can send an unsolicited HTTP/1.1 response onto the socket. When the client reuses that socket for a new request, the injection logic fails to properly validate the socket state, and the injected response gets associated with the new request instead of being discarded. Attack surface requires an attacker-controlled or compromised HTTP/1.1 upstream server and keep-alive connection reuse enabled (keepAliveTimeout > 0). The fix adds proper socket state validation via three new symbols (kIdleSocketValidation, kIdleSocketValidationTimeout, kSocketUsed) to guard against reusing sockets that have received unexpected data. Patches are available in versions 6.27.0, 7.28.0, and 8.5.0.

Affected products

  • nodejs undici < 6.27.0; 7.0.0 < 7.28.0; 8.0.0 < 8.5.0

Timeline

  • 2026-06-17: disclosed: NVD published
  • 2026-06-19: disclosed: GitHub advisory GHSA-35p6-xmwp-9g52 published
  • 2026-06-08: patched: Commit 6ea54ef8c4051e95bb68c89d4a5c9274fe6fbb4b merged
  • 2026-06-19: other: Patches released: v6.27.0, v7.28.0, v8.5.0

References