[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-6734":6},{"stargazers_count":4,"fetched_at":5},7,"2026-07-31T11:19:25.255Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":447,"aliases":448,"duplicate_of":9,"upstream":450,"downstream":451,"duplicates":470,"related":471,"reserved_at":9,"published_at":474,"modified_at":475,"state":476,"summary":477,"references_raw":486,"kevs":572,"epss":573,"epss_history":576,"metrics":633,"affected":641},"CVE-2026-6734","Impact:\nWhen using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination.\n\nThis causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP.\n\nImpacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin.\n\nThis was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0.\n\nPatches:\nUpgrade to undici v7.26.0 or v8.2.0.\n\nWorkarounds:\nUse a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.",null,[11,424],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-346","Origin Validation Error","The product does not properly verify that the source of data or communication is valid.","weakness","Draft","Class",[19,23,76,88,92,263,267,271,275,279,283,287,291,412,416,420],{"id":20,"name":21,"techniques":22},"CAPEC-111","JSON Hijacking (aka JavaScript Hijacking)",[],{"id":24,"name":25,"techniques":26},"CAPEC-141","Cache Poisoning",[27],{"id":28,"name":29,"tactics":30,"countermeasures":37},"T1557.002","ARP Cache Poisoning",[31,34],{"id":32,"name":33},"TA0031","Credential Access",{"id":35,"name":36},"TA0100","Collection",[38,43,47,51,55,59,63,67,71],{"id":39,"name":40,"tactic":41},"D3-UGLPA","User Geolocation Logon Pattern Analysis",{"name":42},"Detect",{"id":44,"name":45,"tactic":46},"D3-PMAD","Protocol Metadata Anomaly Detection",{"name":42},{"id":48,"name":49,"tactic":50},"D3-CSPP","Client-server Payload Profiling",{"name":42},{"id":52,"name":53,"tactic":54},"D3-PHDURA","Per Host Download-Upload Ratio Analysis",{"name":42},{"id":56,"name":57,"tactic":58},"D3-NTSA","Network Traffic Signature Analysis",{"name":42},{"id":60,"name":61,"tactic":62},"D3-APCA","Application Protocol Command Analysis",{"name":42},{"id":64,"name":65,"tactic":66},"D3-NTCD","Network Traffic Community Deviation",{"name":42},{"id":68,"name":69,"tactic":70},"D3-RTSD","Remote Terminal Session Detection",{"name":42},{"id":72,"name":73,"tactic":74},"D3-NTF","Network Traffic Filtering",{"name":75},"Isolate",{"id":77,"name":78,"techniques":79},"CAPEC-142","DNS Cache Poisoning",[80],{"id":81,"name":82,"tactics":83,"countermeasures":87},"T1584.002","DNS Server",[84],{"id":85,"name":86},"TA0042","Resource Development",[],{"id":89,"name":90,"techniques":91},"CAPEC-160","Exploit Script-Based APIs",[],{"id":93,"name":94,"techniques":95},"CAPEC-21","Exploitation of Trusted Identifiers",[96,211,239],{"id":97,"name":98,"tactics":99,"countermeasures":109},"T1134","Access Token Manipulation",[100,103,106],{"id":101,"name":102},"TA0030","Defense Evasion",{"id":104,"name":105},"TA0005","Stealth",{"id":107,"name":108},"TA0111","Privilege Escalation",[110,115,119,123,127,131,135,139,143,148,152,156,161,166,170,174,178,182,187,191,195,199,203,207],{"id":111,"name":112,"tactic":113},"D3-CI","Configuration Inventory",{"name":114},"Model",{"id":116,"name":117,"tactic":118},"D3-NTPM","Network Traffic Policy Mapping",{"name":114},{"id":120,"name":121,"tactic":122},"D3-AM","Access Modeling",{"name":114},{"id":124,"name":125,"tactic":126},"D3-AEM","Application Exception Monitoring",{"name":42},{"id":128,"name":129,"tactic":130},"D3-SCA","System Call Analysis",{"name":42},{"id":132,"name":133,"tactic":134},"D3-CCSA","Credential Compromise Scope Analysis",{"name":42},{"id":136,"name":137,"tactic":138},"D3-OPM","Operational Process Monitoring",{"name":42},{"id":140,"name":141,"tactic":142},"D3-PSA","Process Spawn Analysis",{"name":42},{"id":144,"name":145,"tactic":146},"D3-ST","Session Termination",{"name":147},"Evict",{"id":149,"name":150,"tactic":151},"D3-CR","Credential Revocation",{"name":147},{"id":153,"name":154,"tactic":155},"D3-ANCI","Authentication Cache Invalidation",{"name":147},{"id":157,"name":158,"tactic":159},"D3-DUC","Decoy User Credential",{"name":160},"Deceive",{"id":162,"name":163,"tactic":164},"D3-CH","Credential Hardening",{"name":165},"Harden",{"id":167,"name":168,"tactic":169},"D3-MFA","Multi-factor Authentication",{"name":165},{"id":171,"name":172,"tactic":173},"D3-CRO","Credential Rotation",{"name":165},{"id":175,"name":176,"tactic":177},"D3-TB","Token Binding",{"name":165},{"id":179,"name":180,"tactic":181},"D3-TBA","Token-based Authentication",{"name":165},{"id":183,"name":184,"tactic":185},"D3-RC","Restore Configuration",{"name":186},"Restore",{"id":188,"name":189,"tactic":190},"D3-RIC","Reissue Credential",{"name":186},{"id":192,"name":193,"tactic":194},"D3-SCF","System Call Filtering",{"name":75},{"id":196,"name":197,"tactic":198},"D3-CTS","Credential Transmission Scoping",{"name":75},{"id":200,"name":201,"tactic":202},"D3-EAL","Executable Allowlisting",{"name":75},{"id":204,"name":205,"tactic":206},"D3-EDL","Executable Denylisting",{"name":75},{"id":208,"name":209,"tactic":210},"D3-HBPI","Hardware-based Process Isolation",{"name":75},{"id":212,"name":213,"tactics":214,"countermeasures":216},"T1528","Steal Application Access Token",[215],{"id":32,"name":33},[217,219,221,223,225,227,229,231,233,235,237],{"id":132,"name":133,"tactic":218},{"name":42},{"id":149,"name":150,"tactic":220},{"name":147},{"id":153,"name":154,"tactic":222},{"name":147},{"id":157,"name":158,"tactic":224},{"name":160},{"id":162,"name":163,"tactic":226},{"name":165},{"id":167,"name":168,"tactic":228},{"name":165},{"id":171,"name":172,"tactic":230},{"name":165},{"id":175,"name":176,"tactic":232},{"name":165},{"id":179,"name":180,"tactic":234},{"name":165},{"id":188,"name":189,"tactic":236},{"name":186},{"id":196,"name":197,"tactic":238},{"name":75},{"id":240,"name":241,"tactics":242,"countermeasures":244},"T1539","Steal Web Session Cookie",[243],{"id":32,"name":33},[245,247,249,251,253,255,257,259,261],{"id":132,"name":133,"tactic":246},{"name":42},{"id":149,"name":150,"tactic":248},{"name":147},{"id":153,"name":154,"tactic":250},{"name":147},{"id":157,"name":158,"tactic":252},{"name":160},{"id":162,"name":163,"tactic":254},{"name":165},{"id":167,"name":168,"tactic":256},{"name":165},{"id":171,"name":172,"tactic":258},{"name":165},{"id":188,"name":189,"tactic":260},{"name":186},{"id":196,"name":197,"tactic":262},{"name":75},{"id":264,"name":265,"techniques":266},"CAPEC-384","Application API Message Manipulation via Man-in-the-Middle",[],{"id":268,"name":269,"techniques":270},"CAPEC-385","Transaction or Event Tampering via Application API Manipulation",[],{"id":272,"name":273,"techniques":274},"CAPEC-386","Application API Navigation Remapping",[],{"id":276,"name":277,"techniques":278},"CAPEC-387","Navigation Remapping To Propagate Malicious Content",[],{"id":280,"name":281,"techniques":282},"CAPEC-388","Application API Button Hijacking",[],{"id":284,"name":285,"techniques":286},"CAPEC-510","SaaS User Request Forgery",[],{"id":288,"name":289,"techniques":290},"CAPEC-59","Session Credential Falsification through Prediction",[],{"id":292,"name":293,"techniques":294},"CAPEC-60","Reusing Session IDs (aka Session Replay)",[295,325],{"id":296,"name":297,"tactics":298,"countermeasures":302},"T1134.001","Token Impersonation/Theft",[299,300,301],{"id":101,"name":102},{"id":104,"name":105},{"id":107,"name":108},[303,305,307,309,311,313,315,317,319,321,323],{"id":132,"name":133,"tactic":304},{"name":42},{"id":149,"name":150,"tactic":306},{"name":147},{"id":153,"name":154,"tactic":308},{"name":147},{"id":157,"name":158,"tactic":310},{"name":160},{"id":162,"name":163,"tactic":312},{"name":165},{"id":167,"name":168,"tactic":314},{"name":165},{"id":171,"name":172,"tactic":316},{"name":165},{"id":175,"name":176,"tactic":318},{"name":165},{"id":179,"name":180,"tactic":320},{"name":165},{"id":188,"name":189,"tactic":322},{"name":186},{"id":196,"name":197,"tactic":324},{"name":75},{"id":326,"name":327,"tactics":328,"countermeasures":333},"T1550.004","Web Session Cookie",[329,330],{"id":101,"name":102},{"id":331,"name":332},"TA0109","Lateral Movement",[334,336,338,340,342,344,346,348,350,354,358,360,362,366,370,374,378,380,382,384,386,388,390,392,394,398,400,402,406,410],{"id":39,"name":40,"tactic":335},{"name":42},{"id":44,"name":45,"tactic":337},{"name":42},{"id":48,"name":49,"tactic":339},{"name":42},{"id":52,"name":53,"tactic":341},{"name":42},{"id":56,"name":57,"tactic":343},{"name":42},{"id":60,"name":61,"tactic":345},{"name":42},{"id":64,"name":65,"tactic":347},{"name":42},{"id":68,"name":69,"tactic":349},{"name":42},{"id":351,"name":352,"tactic":353},"D3-PLA","Process Lineage Analysis",{"name":42},{"id":355,"name":356,"tactic":357},"D3-PSMD","Process Self-Modification Detection",{"name":42},{"id":140,"name":141,"tactic":359},{"name":42},{"id":132,"name":133,"tactic":361},{"name":42},{"id":363,"name":364,"tactic":365},"D3-PT","Process Termination",{"name":147},{"id":367,"name":368,"tactic":369},"D3-PS","Process Suspension",{"name":147},{"id":371,"name":372,"tactic":373},"D3-HR","Host Reboot",{"name":147},{"id":375,"name":376,"tactic":377},"D3-HS","Host Shutdown",{"name":147},{"id":149,"name":150,"tactic":379},{"name":147},{"id":153,"name":154,"tactic":381},{"name":147},{"id":157,"name":158,"tactic":383},{"name":160},{"id":162,"name":163,"tactic":385},{"name":165},{"id":167,"name":168,"tactic":387},{"name":165},{"id":171,"name":172,"tactic":389},{"name":165},{"id":188,"name":189,"tactic":391},{"name":186},{"id":72,"name":73,"tactic":393},{"name":75},{"id":395,"name":396,"tactic":397},"D3-KBPI","Kernel-based Process Isolation",{"name":75},{"id":192,"name":193,"tactic":399},{"name":75},{"id":208,"name":209,"tactic":401},{"name":75},{"id":403,"name":404,"tactic":405},"D3-ABPI","Application-based Process Isolation",{"name":75},{"id":407,"name":408,"tactic":409},"D3-WSAM","Web Session Access Mediation",{"name":75},{"id":196,"name":197,"tactic":411},{"name":75},{"id":413,"name":414,"techniques":415},"CAPEC-75","Manipulating Writeable Configuration Files",[],{"id":417,"name":418,"techniques":419},"CAPEC-76","Manipulating Web Input to File System Calls",[],{"id":421,"name":422,"techniques":423},"CAPEC-89","Pharming",[],{"_key":425,"id":425,"name":426,"description":427,"type":15,"status":428,"abstraction":429,"likelihood_of_exploit":9,"capec":430},"CWE-940","Improper Verification of Source of a Communication Channel","The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.","Incomplete","Base",[431,435,439,443],{"id":432,"name":433,"techniques":434},"CAPEC-500","WebView Injection",[],{"id":436,"name":437,"techniques":438},"CAPEC-594","Traffic Injection",[],{"id":440,"name":441,"techniques":442},"CAPEC-595","Connection Reset",[],{"id":444,"name":445,"techniques":446},"CAPEC-596","TCP RST Injection",[],[],[449],"GHSA-hm92-r4w5-c3mj",[],[452,454,456,458,460,462,464,466,468],{"_key":453},"DEBIAN-CVE-2026-6734",{"_key":455},"UBUNTU-CVE-2026-6734",{"_key":457},"RHSA-2026:22380",{"_key":459},"RHSA-2026:22934",{"_key":461},"RHSA-2026:35841",{"_key":463},"RHSA-2026:35891",{"_key":465},"RHSA-2026:38236",{"_key":467},"RHSA-2026:39868",{"_key":469},"RHSA-2026:7378",[],[472],{"_key":473},"CGA-G9RR-JF6Q-QR6X","2026-06-17T16:36:55.439Z","2026-07-21T12:05:03.414Z","PUBLISHED",{"cisa_kev":478,"cisa_ransomware":478,"cisa_vendor":9,"epss_severity":479,"epss_score":480,"severity":481,"severity_score":482,"severity_version":483,"severity_source":484,"severity_vector":485,"severity_status":476},false,"low",0.00315,"high",7.5,"v3.1","cve.org","CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",[487,493,497,502,506,511,517,522,527,532,536,540,544,548,552,556,560,564,568],{"url":488,"sources":489,"tags":491},"https://github.com/nodejs/undici/security/advisories/GHSA-hm92-r4w5-c3mj",[484,490],"osv_npm",[492],"WEB",{"url":494,"sources":495,"tags":496},"https://cna.openjsf.org/security-advisories.html",[484,490],[492],{"url":498,"sources":499,"tags":500},"https://nvd.nist.gov/vuln/detail/CVE-2026-6734",[490],[501],"Advisory",{"url":503,"sources":504,"tags":505},"https://github.com/nodejs/undici/pull/5041",[490],[492],{"url":507,"sources":508,"tags":509},"https://github.com/nodejs/undici",[490],[510],"PACKAGE",{"url":512,"sources":513,"tags":514},"https://access.redhat.com/security/cve/CVE-2026-6734",[484],[515,516],"VDB Entry","X Refsource REDHAT",{"url":518,"sources":519,"tags":520},"https://bugzilla.redhat.com/show_bug.cgi?id=2490024",[484],[521,516],"Issue Tracking",{"url":523,"sources":524,"tags":525},"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6734.json",[484],[526],"X Sadp Csaf Vex",{"url":528,"sources":529,"tags":530},"https://access.redhat.com/errata/RHSA-2026:7378",[484],[531,516],"Vendor Advisory",{"url":533,"sources":534,"tags":535},"https://access.redhat.com/errata/RHSA-2026:22380",[484],[531,516],{"url":537,"sources":538,"tags":539},"https://access.redhat.com/errata/RHSA-2026:22934",[484],[531,516],{"url":541,"sources":542,"tags":543},"https://access.redhat.com/errata/RHSA-2026:35841",[484],[531,516],{"url":545,"sources":546,"tags":547},"https://access.redhat.com/errata/RHSA-2026:35891",[484],[531,516],{"url":549,"sources":550,"tags":551},"https://access.redhat.com/errata/RHSA-2026:34342",[484],[531,516],{"url":553,"sources":554,"tags":555},"https://access.redhat.com/errata/RHSA-2026:36754",[484],[531,516],{"url":557,"sources":558,"tags":559},"https://access.redhat.com/errata/RHSA-2026:36820",[484],[531,516],{"url":561,"sources":562,"tags":563},"https://access.redhat.com/errata/RHSA-2026:38236",[484],[531,516],{"url":565,"sources":566,"tags":567},"https://access.redhat.com/errata/RHSA-2026:39868",[484],[531,516],{"url":569,"sources":570,"tags":571},"https://access.redhat.com/errata/RHSA-2026:41929",[484],[531,516],[],{"date":574,"score":480,"percentile":575},"2026-07-05",0.23298,[577,581,584,587,590,593,597,600,603,606,609,613,616,620,623,626,629,632],{"date":578,"score":579,"percentile":580},"2026-06-18",0.00147,0.04283,{"date":582,"score":579,"percentile":583},"2026-06-19",0.04279,{"date":585,"score":579,"percentile":586},"2026-06-20",0.04274,{"date":588,"score":579,"percentile":589},"2026-06-21",0.04273,{"date":591,"score":579,"percentile":592},"2026-06-22",0.04269,{"date":594,"score":595,"percentile":596},"2026-06-23",0.002,0.0979,{"date":598,"score":595,"percentile":599},"2026-06-24",0.09804,{"date":601,"score":595,"percentile":602},"2026-06-25",0.09898,{"date":604,"score":595,"percentile":605},"2026-06-26",0.0993,{"date":607,"score":595,"percentile":608},"2026-06-27",0.09957,{"date":610,"score":611,"percentile":612},"2026-06-28",0.00235,0.14358,{"date":614,"score":611,"percentile":615},"2026-06-29",0.14356,{"date":617,"score":618,"percentile":619},"2026-06-30",0.00277,0.19392,{"date":621,"score":618,"percentile":622},"2026-07-01",0.19503,{"date":624,"score":618,"percentile":625},"2026-07-02",0.19488,{"date":627,"score":480,"percentile":628},"2026-07-03",0.23276,{"date":630,"score":480,"percentile":631},"2026-07-04",0.23289,{"date":574,"score":480,"percentile":575},[634,639],{"source":484,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":635,"cvss_v4_0":9},{"baseScore":482,"baseSeverity":636,"vectorString":485,"impactScore":637,"exploitabilityScore":638},"HIGH",9.8,4.1,{"source":490,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":640,"cvss_v4_0":9},{"baseScore":482,"baseSeverity":9,"vectorString":485,"impactScore":637,"exploitabilityScore":638},[642,659],{"ecosystem":643,"name":644,"vendor":643,"product":644,"cpe_part":9,"purl_type":645,"purl_namespace":9,"purl_name":644,"source":9,"versions":646},"Npm","undici","npm",[647,655],{"version":648,"is_range":649,"range_type":650,"version_start":651,"version_start_type":652,"version_end":653,"version_end_type":654,"fixed_in":9},"gte7_23_0_lt7_28_0",true,"semver","7.23.0","including","7.28.0","excluding",{"version":656,"is_range":649,"range_type":650,"version_start":657,"version_start_type":652,"version_end":658,"version_end_type":654,"fixed_in":9},"gte8_0_0_lt8_2_0","8.0.0","8.2.0",{"ecosystem":9,"name":644,"vendor":644,"product":644,"cpe_part":660,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":661},"a",[662,665],{"version":663,"is_range":649,"range_type":484,"version_start":651,"version_start_type":652,"version_end":664,"version_end_type":654,"fixed_in":9},">= 7.23.0, \u003C 7.26.0","7.26.0",{"version":666,"is_range":649,"range_type":484,"version_start":657,"version_start_type":652,"version_end":658,"version_end_type":654,"fixed_in":9},">= 8.0.0, \u003C 8.2.0"]