CVE-2026-6734undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse
- 7.5HighCVSS base score
- 0.34%Exploitation in 30 daysEPSS · top 72% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination. This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP. Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin. This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0. Patches: Upgrade to undici v7.26.0 or v8.2.0. Workarounds: Use a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.
Timeline
ID reserved
By openjs
- 58 days later
· 58 days later
Published
- 3 months later
· 3 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| openjsCNA (assigner) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| redhat-SADPADP (enrichment) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.34% · top 72% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Affected products
Affected packages
From reviewed advisories of the GitHub Advisory Database.
References
References23
- https://github.com/nodejs/undici/security/advisories/GHSA-hm92-r4w5-c3mj (opens in a new tab)
- https://cna.openjsf.org/security-advisories.html (opens in a new tab)
- https://access.redhat.com/security/cve/CVE-2026-6734 (opens in a new tab)vdb-entryx_refsource_REDHAT
- RHBZ#2490024 (opens in a new tab)issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6734.json (opens in a new tab)x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:48151 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:35841 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:39868 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:35891 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34342 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36754 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41929 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:38236 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7378 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22380 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22934 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:65126 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60520 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:48124 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36820 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:56431 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:56366 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:57013 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-37760 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-hm92-r4w5-c3mj (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-6734)Record last updated .