3.7

CVE-2026-6733: undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse

Analyzed
AliasesUBUNTU-CVE-2026-6733DEBIAN-CVE-2026-6733CGA-24xv-583g-9pg2
Published 17-06-2026Last modified 17-06-2026

Vulnerability summary

CVE-2026-6733 is a low (CVSS 3.7) vulnerability in nodejs undici. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 12.5% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 3.7, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
3.7/10
010
Low · v3.1 (CVE.org)
EPSS score
0.22%
0%100%
Low · -0.05 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 21 · Related 14
OPENSUSE-SU-2026:11121-1OPENSUSE-SU-2026:21058-1OPENSUSE-SU-2026:21236-1RHSA-2026:35841RHSA-2026:35842RHSA-2026:35891

Timeline

  1. 17-06-2026
    PublishedVulnerability first disclosed.
  2. 17-06-2026
    Last modifiedVulnerability information updated.

Description

Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests. This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: Disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.22%

Chance of exploitation in the next 30 days

Percentile

13%

Versus all other CVEs

30-day change

Decrease -0.05 pp

From 0.27% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard33 products
  • actions-runner< 2.335.1-r1
  • code-server< 4.125.0-r2
  • commercial-gitlab-rails-ee-19.1< 19.1.7-r3
  • commercial-gitlab-rails-ee-19.2< 19.2.7-r1
  • commercial-gitlab-rails-ee-19.3< 19.3.3-r1
Wolfi8 products
  • code-server< 4.125.0-r2
  • node-gyp< 13.0.0-r1
  • npm< 11.17.0-r1
  • prism< 5.15.11-r3
  • renovate< 43.247.0-r0 | < 43.249.5-r2
Debian1 product
  • node-undiciAll versions (No fix recorded) | < 8.5.0+dfsg+~cs3.2.0-1
Nodejs1 product
  • undici< 6.27.0 | ≥ 7.0.0, < 7.28.0 | ≥ 8.0.0, < 8.5.0
Npm1 product
  • undici< 6.27.0 | ≥ 7.0.0, < 7.28.0 | ≥ 8.0.0, < 8.5.0
Ubuntu1 product
  • node-undiciAll versions (No fix recorded)
Undici1 product
  • undici< 6.26.0 | ≥ 7.0.0, < 7.28.0 | ≥ 8.0.0, < 8.5.0

7 vendors · 46 products

References

13 links
Show all 13 references