CVE-2026-6734: undici Socks5ProxyAgent Cross-Origin Pool Reuse Vulnerability

Technical summary

The vulnerability stems from improper connection pool management in undici's Socks5ProxyAgent implementation. When a proxy agent is instantiated, it creates a single connection pool keyed to the first origin it connects to. Subsequent requests to different origins are incorrectly dispatched through this same pool without origin verification. The agent fails to validate that the pooled connection's origin matches the current request's target origin before reusing the connection. This violation of origin isolation allows an attacker or misconfigured application to inadvertently send authenticated requests, sensitive headers, and request bodies to unintended recipients. Additionally, because the connection is already established to a specific origin via the proxy, HTTPS enforcement is bypassed for requests to alternative origins, enabling silent protocol downgrade attacks. The flaw was introduced via PR #4385 in version 7.23.0 and affects all releases from 7.23.0 through 8.1.0 inclusive.

Business impact

Organizations relying on undici for proxied HTTP/HTTPS communication face credential leakage, data exposure, and man-in-the-middle vulnerabilities. In multi-tenant or microservice architectures where a single agent might proxy requests to multiple internal or external services, this bug creates a cross-origin data exfiltration channel. Sensitive information—authentication tokens, API keys, PII, or request payloads—can be misdirected to an attacker-controlled or compromised origin. The silent downgrade of HTTPS to HTTP means encrypted traffic protections are negated without warning. For services processing financial transactions, healthcare data, or other regulated content, this violates data protection and confidentiality requirements. Incident response and breach investigation become difficult because logs may show requests appearing to come from or go to the wrong origin, obscuring the attack surface.

Affected systems

The vulnerability affects Node.js applications using the undici library versions 7.23.0 through 8.1.0 that employ Socks5ProxyAgent for proxied HTTP requests. This includes direct instantiation of Socks5ProxyAgent as well as indirect usage via setGlobalDispatcher(). Any application using undici as an HTTP client or as a dependency of a higher-level framework (such as Node.js fetch implementations) with proxy configuration is potentially vulnerable if it makes requests to multiple origins. Development and production environments are equally at risk. Applications using other proxy agent types (HttpProxyAgent, HttpsProxyAgent) or not using proxy functionality are not affected.

Exploitability

Exploitation requires two conditions: the target application must use Socks5ProxyAgent and must make authenticated or sensitive requests to at least two different origins. An attacker cannot directly trigger this flaw remotely; the vulnerability manifests when the application's own code requests data from multiple origins through a misconfigured proxy setup. However, the barrier to exploitation is low because no special attack technique is required—the normal operation of the application triggers the cross-origin routing bug. If an attacker can influence which origins an application targets (via URL injection, configuration tampering, or compromised dependencies), they can steer sensitive requests to their own server. Internal networks where Socks5 proxies are deployed to access multiple microservices are particularly vulnerable to lateral movement and data theft. The CVSS score of 7.5 reflects high confidentiality and integrity impact but assumes the attacker has some level of privilege or control over the application's behavior.

Remediation

Upgrade undici immediately to version 7.26.0 or version 8.2.0, both of which contain the fix. Verify the installed version in your package-lock.json or yarn.lock file and test the upgrade in a staging environment to confirm compatibility with your application. As a temporary measure if immediate patching is not possible, refactor your code to create a separate Socks5ProxyAgent instance for each distinct origin you communicate with, or avoid using Socks5ProxyAgent altogether and switch to a different proxy strategy that does not reuse pools across origins. Code review any recent changes to proxy configuration or multi-origin requests to identify whether this flaw has been actively exploited.

Patch guidance

Install undici v7.26.0 or v8.2.0 via npm, yarn, or your package manager of choice. If you are on the v7 branch, apply v7.26.0; if on v8, apply v8.2.0 or later. Review your application's direct and transitive dependencies to ensure no pinned version constraints prevent the upgrade. After patching, restart all Node.js processes running the updated library. Test outbound proxy requests to multiple origins in a controlled environment to confirm that data is routed to the correct destination and that HTTPS enforcement is maintained. Monitor application logs for any anomalous request patterns that might indicate prior exploitation.

Detection guidance

Examine server access logs for requests arriving from your application that were intended for a different origin—look for authentication tokens, API keys, or request bodies appearing on unexpected servers. In proxy logs, check for requests from your application to origin A that are then forwarded to origin B, or vice versa. Monitor HTTPS downgrade attempts (HTTP requests to origins that should be HTTPS). If you control the application code, add logging to Socks5ProxyAgent initialization to confirm it is being instantiated once per origin, not globally. Network segmentation and outbound traffic filtering by origin can help contain the blast radius. Correlate application request logs with server logs to identify mismatched request-response pairs. Review commit history in your codebase for recent additions or modifications to proxy configuration around the time versions 7.23.0-8.1.0 were released.

Why prioritize this

Although not yet listed in CISA KEV, this is a HIGH severity vulnerability with straightforward remediation. The combination of credential leakage, silent protocol downgrade, and broad applicability to Node.js applications using undici makes it a high-priority patch. The fix is available and does not require architectural refactoring. Organizations should prioritize this for their next regular patching cycle, or immediately if running multi-origin proxy scenarios handling sensitive data. The low barrier to triggering the flaw once an application uses the vulnerable code path justifies elevated urgency.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible flaw with high impact on confidentiality and integrity (C:H, I:H). The attack complexity is marked as High because exploitation requires the application to be configured for multiple origins and the attacker must have some privilege or control to influence request routing. Availability is rated as High in theory, though practical denial-of-service from this flaw is less likely than data leakage. The requirement for authenticated requests (PR:L) reflects the fact that the vulnerability is most damaging when the application is already authenticated to at least one origin. The vulnerability does not require user interaction, making it stealthier than many other bugs. The rating appropriately balances the ease of triggering the flaw in affected configurations against the severity of the impact.

Frequently asked questions