LowGHSA-35p6-xmwp-9g52CVE-2026-6733

undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse

Published 19 Jun 2026 · Updated 10 Sept 2026

Affected packages

undicinpm
Affected
<6.27.0
Fixed in
6.27.0
Update to the fixed version for your release line, for example:npm install undici@6.27.0
undicinpm
Affected
>=7.0.0 <7.28.0
Fixed in
7.28.0
Update to the fixed version for your release line, for example:npm install undici@7.28.0
undicinpm
Affected
>=8.0.0 <8.5.0
Fixed in
8.5.0
Update to the fixed version for your release line, for example:npm install undici@8.5.0

Details

Impact

Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests.

This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse.

Patches

Upgrade to undici v6.27.0, v7.28.0 or v8.5.0.

Workarounds

Disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.

Is GHSA-35p6-xmwp-9g52 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected undici, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.