What is CVE-2026-6733?

CVE-2026-6733 is a low-severity vulnerability in Undici, classified under Time-of-check Time-of-use (TOCTOU) Race Condition. CVSS score: 3.7/10. Published 2026-06-17.

How severe is CVE-2026-6733?

Low severity. CVSS v3 base score is 3.7 out of 10.

Vulnerability in Undici

CVE-2026-6733

Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When…

Vulnerability class: TOCTOU (Time-of-Check to Time-of-Use)

CVSS v3 metric

CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N.

Affected products

Undici — versions 0, 6.26.0, 7.0.0

Weakness classification (CWE)

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition

References

ce714d77-add3-4f53-aff5-83d477b104bb
ce714d77-add3-4f53-aff5-83d477b104bb
ce714d77-add3-4f53-aff5-83d477b104bb

Frequently asked questions

What is CVE-2026-6733?: CVE-2026-6733 is a low-severity vulnerability in Undici, classified under Time-of-check Time-of-use (TOCTOU) Race Condition. CVSS score: 3.7/10. Published 2026-06-17.
How severe is CVE-2026-6733?: Low severity. CVSS v3 base score is 3.7 out of 10.