undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-6733 · CVE overview and exploitation status

EUVD-2026-37769

GHSA-35p6-xmwp-9g52

cve-program · CVE-2026-6733

• https://github.com/nodejs/undici/security/advisories/GHSA-35p6-xmwp-9g52
• https://hackerone.com/reports/3582376
• https://cna.openjsf.org/security-advisories.html

euvd · EUVD-2026-37769

• https://github.com/nodejs/undici/security/advisories/GHSA-35p6-xmwp-9g52
• https://hackerone.com/reports/3582376
• https://cna.openjsf.org/security-advisories.html

nvd · CVE-2026-6733

• https://cna.openjsf.org/security-advisories.html
• https://github.com/nodejs/undici/security/advisories/GHSA-35p6-xmwp-9g52
• https://hackerone.com/reports/3582376

osv · GHSA-35p6-xmwp-9g52

• https://github.com/nodejs/undici/security/advisories/GHSA-35p6-xmwp-9g52
• https://nvd.nist.gov/vuln/detail/CVE-2026-6733
• https://github.com/nodejs/undici/commit/6ea54ef8c4051e95bb68c89d4a5c9274fe6fbb4b
• https://hackerone.com/reports/3582376
• https://cna.openjsf.org/security-advisories.html
• https://github.com/nodejs/undici
• https://github.com/nodejs/undici/releases/tag/v6.27.0
• https://github.com/nodejs/undici/releases/tag/v7.28.0
• https://github.com/nodejs/undici/releases/tag/v8.5.0

• Impact: · Advisory content revised · 9 Nov 2026
• Impact: · Advisory content revised · 1 Nov 2026