CVE-2026-6734: undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse
Vulnerability summary
CVE-2026-6734 is a high (CVSS 8.8) Origin Validation Error vulnerability in nodejs undici. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 28.1% of scored vulnerabilities.
Not severe (CVSS 7.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 7 · Related 1Timeline
- 17-06-2026PublishedVulnerability first disclosed.
- 10-09-2026Last modifiedVulnerability information updated.
Description
Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination. This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP. Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin. This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0. Patches: Upgrade to undici v7.26.0 or v8.2.0. Workarounds: Use a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.
CVSS metrics
7 scores · 7 sources · 1 version- CVE.orgCNA7.5HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.34%
Chance of exploitation in the next 30 days
Percentile
28%
Versus all other CVEs
30-day change
Decrease -0.04 pp
From 0.39% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-346Origin Validation ErrorThe product does not properly verify that the source of data or communication is valid.
- CWE-940Improper Verification of Source of a Communication ChannelThe product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.
Affected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard23 products
- code-server< 4.125.0-r2
- commercial-gitlab-rails-ee-19.1< 19.1.7-r3
- commercial-gitlab-rails-ee-19.2< 19.2.7-r1
- commercial-gitlab-rails-ee-19.3< 19.3.3-r1
- commercial-gitlab-rails-ee-fips-19.1All versions (No fix recorded) | < 19.1.9-r0
Wolfi4 products
- code-server< 4.125.0-r2
- renovate< 43.247.0-r0
- vitess-24< 24.0.2-r1
- vitess-24-compat< 24.0.3-r7
Debian1 product
- node-undiciAll versions (No fix recorded) | < 8.5.0+dfsg+~cs3.2.0-1
Nodejs1 product
- undici≥ 7.23.0, < 7.28.0 | ≥ 8.0.0, < 8.2.0
Npm1 product
- undici≥ 7.23.0, < 7.28.0 | ≥ 8.0.0, < 8.2.0
Ubuntu1 product
- node-undiciAll versions (No fix recorded)
Undici1 product
- undici≥ 7.23.0, < 7.26.0 | ≥ 8.0.0, < 8.2.0
7 vendors · 32 products
References
30 links- github.com/nodejs/undici/security/advisories/GHSA-hm92-r4w5-c3mjREPORTAdvisoryWEBMitigationVendor Advisory
Show all 30 references
- github.com/nodejs/undiciPACKAGE