What is the CVSS score of CVE-2026-6733?

CVE-2026-6733 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-6733?

Yes, a patch is available for CVE-2026-6733. Update the affected software to the latest version immediately.

Undici CVE-2026-6733

EUVD-2026-37769 LOW

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-06-17 openjs

GHSA-35p6-xmwp-9g52

Code Injection Undici

3.7

CVSS 3.1 · Vendor: openjs

Severity by source

Vendor (openjs) PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

3.7 LOW

Upstream server control is a genuine non-trivial prerequisite (AC:H); no client-side privileges are required (PR:N); impact is limited to response integrity misrouting with no confidentiality or availability consequence.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (openjs).

CVSS VectorVendor: openjs

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jun 19, 2026 - 16:01 EUVD

Analysis Generated

Jun 17, 2026 - 18:11 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

28 npm packages depend on undici (16 direct, 23 indirect)

Ecosystem-wide dependent count for version 7.0.0.

DescriptionCVE.org

Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests.

This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse.

Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.

Workarounds: Disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.

AnalysisAI

Response queue poisoning in Undici's HTTP/1.1 client allows an attacker-controlled or compromised upstream server to inject unsolicited HTTP responses onto idle keep-alive sockets, causing subsequent outbound requests to receive falsified responses. All Undici versions across the v6, v7, and v8 branches prior to the patched releases are affected when keep-alive connection reuse is active (the default). While the CVSS score is low (3.7) and no public exploit or KEV listing exists, the integrity impact can carry significant business logic consequences in applications that proxy requests through third-party or partially trusted upstream servers.

Technical ContextAI

Undici is a high-performance HTTP/1.1 client library for Node.js, widely used both directly and as the underlying transport for the Node.js built-in fetch() API. The vulnerability arises from how Undici manages persistent keep-alive connections: after a request-response cycle completes, the socket is returned to the connection pool for reuse. CWE-367 (Time-of-check Time-of-use) is assigned, reflecting a race condition in the window between a socket becoming idle and the client dispatching the next request on it. An attacker who controls the upstream HTTP/1.1 server exploits this window by injecting a crafted, unsolicited HTTP response onto the idle socket. When Undici dispatches the next request on that socket, it associates the pre-injected response with the new request, silently delivering attacker-controlled data to the application. The affected CPE cpe:2.3:a:undici:undici:*:*:*:*:*:*:*:* covers all versions prior to the fixes.

RemediationAI

Upgrade Undici to v6.26.0, v7.28.0, or v8.5.0 depending on the currently deployed major branch; these are the vendor-confirmed fixed releases per the GitHub Security Advisory GHSA-35p6-xmwp-9g52. If an immediate upgrade is not feasible, the vendor-documented workaround is to disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Undici Client or Pool instance. This eliminates the injection window entirely but removes TCP connection reuse, increasing per-request latency and connection overhead - a significant trade-off for high-throughput applications. Applications that proxy to untrusted, third-party, or multi-tenant upstream servers should treat the upgrade as elevated priority regardless of the low base score, given that response misrouting in those contexts can corrupt application logic silently.