Response Queue Poisoning Vulnerability in Undici HTTP Client

CVE-2026-6733

What is CVE-2026-6733?

The Undici HTTP/1.1 client is susceptible to a response queue poisoning vulnerability that arises when keep-alive sockets are reused. In scenarios where an attacker controls an upstream HTTP/1.1 server, they can manipulate socket connections to inject unsolicited responses after previous requests. This injection leads to incorrect response handling, where the injected response is misassociated with the next legitimate request made on the same socket. Mitigations include upgrading to specified patched versions or disabling connection reuse by adjusting the keep-alive timeout.

References