Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests.
This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse.
Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.
Workarounds: Disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.
CVSS Details
- CVSS 3.1 Base Score: 3.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade npmUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade v8-12.4-develUpgrade v8-13.6-develUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-devel | Jul 7, 2026 | Jul 6, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs24-debugsourceUpgrade v8-13.6-develUpgrade nodejs22-full-i18nUpgrade nodejs24-debuginfoUpgrade nodejs22-docsUpgrade nodejs24Upgrade v8-12.4-develUpgrade nodejs22-debuginfoUpgrade nodejs22Upgrade nodejs22-libs-debuginfoUpgrade nodejs24-libs-debuginfoUpgrade nodejs22-debugsourceUpgrade nodejs22-npmUpgrade nodejs24-libsUpgrade nodejs22-develUpgrade nodejs22-libsUpgrade nodejs24-npmUpgrade nodejs24-develUpgrade nodejs24-full-i18nUpgrade nodejs24-docs | Jul 8, 2026 | Jun 17, 2026 |
| Redhat_linux | — | Upgrade nodejs-docsUpgrade v8-12.4-develNo solution existsUpgrade nodejs24-debuginfoUpgrade nodejs-npmUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejs24-debugsourceUpgrade nodejs22-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade v8-13.6-develUpgrade nodejs-packagingUpgrade nodejs24Upgrade nodejs-develUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-libsUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs22-debugsourceUpgrade nodejs-libsUpgrade nodejs-packaging-bundlerUpgrade nodejs24-develUpgrade nodejs24-npmUpgrade nodejs24-full-i18nUpgrade nodejsUpgrade nodejs24-docs | Jul 7, 2026 | Jun 17, 2026 |
| Rocky_linux | — | Upgrade nodejsUpgrade nodejs22-debugsourceUpgrade nodejs-libsUpgrade nodejs22-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs24-develUpgrade nodejs-libs-debuginfoUpgrade nodejs24-libsUpgrade nodejs24-debugsourceUpgrade nodejs-npmUpgrade nodejs24-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs24-full-i18nUpgrade nodejs-develUpgrade npmUpgrade nodejs24-libs-debuginfoUpgrade v8-12.4-develUpgrade nodejs-debuginfoUpgrade v8-13.6-develUpgrade nodejs24 | Jul 10, 2026 | Jul 7, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub