Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination.
This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP.
Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin.
This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0.
Patches: Upgrade to undici v7.26.0 or v8.2.0.
Workarounds: Use a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade v8-13.6-develUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade npm | Jul 7, 2026 | Jul 6, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs24-libsUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-npmUpgrade nodejs24Upgrade nodejs24-full-i18nUpgrade nodejs24-develUpgrade nodejs24-docsUpgrade v8-13.6-develUpgrade nodejs24-debuginfoUpgrade nodejs24-debugsource | Jul 8, 2026 | Jun 17, 2026 |
| Redhat_linux | — | Upgrade nodejs-libs-debuginfoUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs24-full-i18nUpgrade nodejs24-develUpgrade nodejs24-libsUpgrade nodejs-packagingUpgrade nodejs24Upgrade v8-13.6-develUpgrade nodejs-docsUpgrade nodejs-debuginfoUpgrade nodejs24-debugsourceUpgrade nodejs-packaging-bundlerUpgrade nodejs-libsUpgrade nodejs-nodemonUpgrade nodejs24-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs24-docsUpgrade nodejs24-npmUpgrade npmUpgrade nodejs24-libs-debuginfo | Jul 7, 2026 | Jun 17, 2026 |
| Rocky_linux | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs24-full-i18nUpgrade nodejs24-debugsourceUpgrade nodejs24-debuginfoUpgrade nodejs24-develUpgrade nodejs24-libs-debuginfoUpgrade nodejs-libsUpgrade nodejs24Upgrade nodejs-full-i18nUpgrade nodejs24-libsUpgrade nodejsUpgrade v8-13.6-develUpgrade nodejs-devel | Jul 13, 2026 | Jul 7, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub