Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests.
This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse.
Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.
Workarounds: Disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade npmUpgrade v8-13.6-develUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade v8-12.4-develUpgrade nodejs-docsUpgrade nodejs-nodemon | Jul 7, 2026 | Jul 6, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs22-docsUpgrade nodejs24Upgrade nodejs24-debugsourceUpgrade v8-13.6-develUpgrade v8-12.4-develUpgrade nodejs22-full-i18nUpgrade nodejs22Upgrade nodejs22-debuginfoUpgrade nodejs22-libs-debuginfoUpgrade nodejs24-debuginfoUpgrade nodejs22-debugsourceUpgrade nodejs24-docsUpgrade nodejs24-develUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-libsUpgrade nodejs22-develUpgrade nodejs24-npmUpgrade nodejs22-npmUpgrade nodejs22-libsUpgrade nodejs24-full-i18n | Jul 8, 2026 | Jun 17, 2026 |
| Redhat_linux | — | Upgrade nodejs24-debugsourceUpgrade nodejs-debuginfoUpgrade v8-13.6-develUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-npmUpgrade v8-12.4-develUpgrade nodejs-debugsourceUpgrade nodejs-nodemonUpgrade nodejs22-debuginfoUpgrade nodejs24-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs-docsNo solution existsUpgrade nodejs24Upgrade nodejs24-libsUpgrade nodejs-full-i18nUpgrade nodejs24-develUpgrade nodejs24-npmUpgrade nodejs24-full-i18nUpgrade npmUpgrade nodejs-libsUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs24-docsUpgrade nodejs24-libs-debuginfoUpgrade nodejs22-debugsource | Jul 7, 2026 | Jun 17, 2026 |
| Rocky_linux | — | Upgrade nodejs24-debugsourceUpgrade nodejs22-debuginfoUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs22-debugsourceUpgrade nodejs-libsUpgrade nodejs24-libsUpgrade nodejs24-develUpgrade nodejs-libs-debuginfoUpgrade nodejs24-debuginfoUpgrade v8-12.4-develUpgrade nodejs-npmUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade npmUpgrade nodejs24-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs24Upgrade v8-13.6-develUpgrade nodejs24-full-i18n | Jul 10, 2026 | Jul 7, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub