What is the CVSS score of CVE-2026-9697?

CVE-2026-9697 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of undici are affected by CVE-2026-9697?

Undici versions 7.23.0 through 7.27.x and 8.x prior to 8.5.0 contain a TLS pinning bypass vulnerability that allows network-positioned attackers to conduct man-in-the-middle attacks against HTTPS…. A patch is available.

How to fix or mitigate CVE-2026-9697?

Within 24 hours: Inventory all production systems using undici (versions 7.23.0-7.27.x or 8.0.0-8.4.x) with SOCKS5 proxy configurations. Within 7 days: Disable SOCKS5 proxy usage for affected undici instances or migrate to alternative HTTP clients; implement network-level monitoring to detect unusual certificate validation patterns. Within 30 days: Monitor for undici 8.5.0+ release and upgrade immediately upon availability; validate that TLS pinning controls are re-enabled in the updated version.

undici CVE-2026-9697

EUVD-2026-37763 HIGH

Improper Certificate Validation (CWE-295)

2026-06-17 openjs

GHSA-vmh5-mc38-953g

Microsoft Mozilla Authentication Bypass Undici

7.4

CVSS 3.1 · Vendor: openjs

Severity by source

Vendor (openjs) PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.4 HIGH

Network-reachable MITM with no auth or user interaction, but AC:H because the attacker needs both proxy-path positioning and a Mozilla-trusted cert; full read/tamper of TLS, no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.4 HIGH

qualitative

Primary rating from Vendor (openjs).

CVSS VectorVendor: openjs

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 18, 2026 - 17:02 EUVD

Analysis Generated

Jun 17, 2026 - 18:02 vuln.today

CVE Published

Jun 17, 2026 - 16:46 cve.org

HIGH 7.4

DescriptionCVE.org

Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings.

Applications that pin to an internal or corporate CA via requestTls.ca will, when their proxy URI is SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed by any publicly-trusted CA for the target hostname is accepted, breaking the intended pin and enabling MITM read and tamper of the HTTPS exchange.

Affected applications are those that use undici's ProxyAgent (or Socks5ProxyAgent directly) with SOCKS5 AND rely on requestTls for TLS scope restriction. The bug was introduced in undici 7.23.0 when SOCKS5 support was added.

Patches: Upgrade to undici v7.28.0 or v8.5.0.

Workarounds: No workaround is available within the SOCKS5 path. If a SOCKS5 proxy with TLS scope restriction is required and an upgrade is not yet possible, route the traffic through an HTTP-proxy ProxyAgent instead, where requestTls is honored correctly.

AnalysisAI

TLS pinning bypass in undici 7.23.0 through 7.27.x and 8.x prior to 8.5.0 allows network-positioned attackers to perform man-in-the-middle attacks on HTTPS traffic routed through SOCKS5 proxies. The ProxyAgent silently drops the requestTls option (including ca, cert, key, rejectUnauthorized, and servername) when the proxy URI uses socks5:// or socks://, causing connections to fall back to Node.js's default Mozilla CA bundle instead of the application-configured trust anchor. No public exploit identified at time of analysis, but the CWE-295 improper certificate validation flaw directly defeats corporate CA pinning controls.

Technical ContextAI

undici is the official Node.js HTTP/1.1 client library that powers fetch() in modern Node releases. Its ProxyAgent abstraction supports tunneling through HTTP CONNECT and, since version 7.23.0, SOCKS5 proxies via an internal Socks5ProxyAgent. The bug is a CWE-295 (Improper Certificate Validation) where the SOCKS5 code path fails to propagate the requestTls option into the TLS upgrade performed on the tunneled socket - so the secure socket is created with Node's default tls.connect options. This effectively reverts trust evaluation to the bundled Mozilla root store and disables any caller-supplied pinning, mutual-TLS material, or hostname override, even though the same configuration is honored on the HTTP-CONNECT proxy path. The CPE cpe:2.3:a:undici:undici:*:*:* confirms the upstream npm package is the only affected component.

RemediationAI

Vendor-released patch: upgrade undici to v7.28.0 or v8.5.0, which propagate requestTls through the SOCKS5 code path; this is the only complete fix and should be applied via the project's package manager (npm/yarn/pnpm) and any transitive dependents that pin older undici. No in-path workaround exists for the SOCKS5 connector, so if upgrading is blocked, the vendor recommends switching the proxy URI to an HTTP-proxy ProxyAgent (http:// or https://) where requestTls is honored - note this requires deploying or fronting the SOCKS5 endpoint with an HTTP CONNECT proxy and may break environments that mandate SOCKS5 for policy reasons. As an interim compensating control, audit code paths that combine ProxyAgent with socks5://, and either disable SOCKS5 routing for TLS-pinned destinations or move the affected outbound calls to a different HTTP client until patching is complete. See https://github.com/nodejs/undici/security/advisories/GHSA-vmh5-mc38-953g for the canonical advisory.