Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests.
This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse.
Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.
Workarounds: Disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-libsUpgrade v8-13.6-develUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade v8-12.4-develUpgrade npmUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-packaging-bundler | Jul 7, 2026 | Jul 6, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs24-debuginfoUpgrade nodejs22Upgrade nodejs24Upgrade nodejs22-docsUpgrade v8-12.4-develUpgrade nodejs24-debugsourceUpgrade nodejs22-debuginfoUpgrade nodejs22-full-i18nUpgrade v8-13.6-develUpgrade nodejs22-libs-debuginfoUpgrade nodejs22-debugsourceUpgrade nodejs24-libsUpgrade nodejs22-npmUpgrade nodejs24-develUpgrade nodejs24-full-i18nUpgrade nodejs22-develUpgrade nodejs24-npmUpgrade nodejs22-libsUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-docs | Jul 8, 2026 | Jun 17, 2026 |
| Redhat_linux | — | Upgrade nodejs-debuginfoUpgrade v8-13.6-develUpgrade nodejs24-debugsourceUpgrade nodejs22-debuginfoUpgrade nodejs24-debuginfoUpgrade v8-12.4-develUpgrade nodejs-docsNo solution existsUpgrade nodejs24Upgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-npmUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs24-docsUpgrade nodejsUpgrade nodejs22-debugsourceUpgrade nodejs24-libsUpgrade nodejs-full-i18nUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-npmUpgrade nodejs24-develUpgrade nodejs24-full-i18nUpgrade nodejs-packaging-bundlerUpgrade nodejs-libs | Jul 7, 2026 | Jun 17, 2026 |
| Rocky_linux | — | Upgrade npmUpgrade nodejs-develUpgrade nodejs24-libs-debuginfoUpgrade nodejs-npmUpgrade nodejs24-full-i18nUpgrade nodejs24-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs24Upgrade v8-13.6-develUpgrade nodejs-debuginfoUpgrade v8-12.4-develUpgrade nodejs24-develUpgrade nodejs-full-i18nUpgrade nodejs24-libsUpgrade nodejs24-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejsUpgrade nodejs22-debugsourceUpgrade nodejs22-debuginfoUpgrade nodejs-libs | Jul 10, 2026 | Jul 7, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub