Skip to main content

undici CVE-2026-6734

| EUVDEUVD-2026-37760 HIGH
Origin Validation Error (CWE-346)
2026-06-17 openjs GHSA-hm92-r4w5-c3mj
Information Disclosure Undici
8.8
CVSS 3.1 · NVD
Share

Severity by source

Vendor (openjs) PRIMARY
HIGH
qualitative
NVD
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.4 HIGH

Requires a non-default multi-origin SOCKS5 configuration and dependent connection ordering (AC:H); attacker needs no victim privileges (PR:N); confidentiality and wrong-origin trust give C:H/I:H, with no real availability loss (A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (openjs).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

7
Analysis Updated
Jun 27, 2026 - 23:58 vuln.today
v3 (cvss_changed)
Source Code Evidence Fetched
Jun 27, 2026 - 23:58 vuln.today
Analysis Updated
Jun 27, 2026 - 23:58 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 27, 2026 - 23:52 vuln.today
cvss_changed
CVSS changed
Jun 27, 2026 - 23:52 NVD
7.5 (HIGH) 8.8 (HIGH)
Patch available
Jun 19, 2026 - 16:01 EUVD
Analysis Generated
Jun 17, 2026 - 18:02 vuln.today

DescriptionNVD

Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination.

This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP.

Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin.

This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0.

Patches: Upgrade to undici v7.26.0 or v8.2.0.

Workarounds: Use a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.

AnalysisAI

Cross-origin request misrouting in undici's Socks5ProxyAgent (introduced in 7.23.0, affecting all releases through 8.1.0) causes the library to reuse a single SOCKS5 connection pool bound to the first-seen origin for every subsequent origin, so credentials and request bodies destined for origin B are silently sent to and trusted from origin A, and HTTPS targets may be downgraded to HTTP. Any Node.js application using Socks5ProxyAgent (directly or via setGlobalDispatcher) that contacts more than one origin is exposed. No public exploit identified at time of analysis; CISA SSVC records exploitation as none and EPSS is very low (0.15%, 4th percentile), but the GHSA advisory ships a regression test demonstrating the misrouting.

Technical ContextAI

undici is the high-performance HTTP/1.1 client that underpins Node.js's global fetch and is consumed by a large share of the Node ecosystem. The defect is in lib/dispatcher/socks5-proxy-agent.js: the agent cached a single Pool in a kPool symbol keyed to nothing, so the first request through the SOCKS5 tunnel established the pool's origin and all later requests reused that same TCP/TLS connection regardless of their intended host. This is a textbook CWE-346 (Origin Validation Error) - the dispatcher never compared the requested origin against the pool's connected origin. The fix (PR #5041) replaces kPool with a kPools Map keyed by String(origin), creating and caching one Pool per distinct origin. The affected CPE is cpe:2.3:a:undici:undici:*, scoped to the SOCKS5 proxy code path added in PR #4385.

RemediationAI

Vendor-released patch: undici 7.28.0 (for the 7.x line) or 8.2.0 (for the 8.x line); upgrade the dependency to one of these via package manager and rebuild, ensuring transitive copies are also bumped (note the inline description's '7.26.0' is superseded by the GHSA advisory and package metadata, which state the 7.x fix is 7.28.0 - use 7.28.0). The fix is implemented in PR https://github.com/nodejs/undici/pull/5041. If you cannot upgrade immediately, the vendor-supported workarounds are to instantiate a separate Socks5ProxyAgent instance per origin (each agent then only ever sees one origin, sidestepping the shared-pool bug) or to stop using Socks5ProxyAgent for any code path that talks to more than one origin; the trade-off is added connection-management overhead and the need to audit every call site that uses setGlobalDispatcher, since a global dispatcher centralizes all origins through one vulnerable agent. Refer to the GHSA advisory (https://github.com/nodejs/undici/security/advisories/GHSA-hm92-r4w5-c3mj) for confirmation.

More in Undici

View all
CVE-2022-35949 CRITICAL POC
9.8 Aug 12

undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forge
CVE-2026-12151 HIGH POC
7.5 Jun 17

Memory exhaustion denial of service in the undici WebSocket client (versions 6.17.0 and later) allows a malicious or com
CVE-2026-14643 HIGH POC
7.5 Jul 29

Cross-user information disclosure in undici's cache interceptor allows authenticated users' responses to be served from

CVE-2026-16729 MEDIUM POC
6.5 Jul 29

Cookie attribute injection in undici's setCookie function allows attacker-controlled domain values or unparsed array ent
CVE-2022-31151 MEDIUM POC
6.5 Jul 21

Authorization headers are cleared on cross-origin redirect. Rated medium severity (CVSS 6.5), this vulnerability is remo
CVE-2022-32210 MEDIUM POC
6.5 Jul 14

`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to th
CVE-2026-15157 MEDIUM POC
5.4 Jul 29

CRLF injection in undici's HTTP/1.1 dispatcher enables HTTP header injection and potential request smuggling when applic
CVE-2023-23936 MEDIUM POC
5.4 Feb 16

Undici is an HTTP/1.1 client for Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable,

CVE-2022-35948 MEDIUM POC
5.3 Aug 15

undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection
CVE-2026-13697 CRITICAL
9.1 Jul 29

Cross-user information disclosure and a parse-time denial of service in undici's HTTP cache interceptor affect versions

CVE-2026-9675 HIGH
7.5 Jun 17

Denial-of-service in the undici WebSocket client (Node.js HTTP/WebSocket library) version 8.1.0 through versions prior t
CVE-2026-2229 HIGH
7.5 Mar 12

Node.js undici WebSocket client denial-of-service vulnerability allows remote attackers to crash the process by sending

Same weakness CWE-346 – Origin Validation Error

View all
CVE-2015-4495 HIGH POC
8.8
CVE-2025-34291 CRITICAL POC
9.4
CVE-2020-16952 HIGH POC
8.6
CVE-2022-50925 CRITICAL POC
9.8
CVE-2024-25124 CRITICAL POC
9.8
CVE-2023-29711 CRITICAL POC
9.8
CVE-2023-33443 CRITICAL POC
9.8
CVE-2023-29728 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-6734 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy