Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination.
This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP.
Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin.
This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0.
Patches: Upgrade to undici v7.26.0 or v8.2.0.
Workarounds: Use a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-develUpgrade v8-13.6-develUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade npmUpgrade nodejs-libsUpgrade nodejs-nodemon | Jul 7, 2026 | Jul 6, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs24-full-i18nUpgrade nodejs24-libsUpgrade nodejs24Upgrade nodejs24-develUpgrade nodejs24-npmUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-docsUpgrade nodejs24-debuginfoUpgrade v8-13.6-develUpgrade nodejs24-debugsource | Jul 8, 2026 | Jun 17, 2026 |
| Redhat_linux | — | Upgrade nodejs24-develUpgrade nodejs-debugsourceUpgrade nodejs-packaging-bundlerUpgrade nodejs-docsUpgrade nodejs24-libsUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs24Upgrade nodejs24-debugsourceUpgrade v8-13.6-develUpgrade nodejs-packagingUpgrade nodejs24-full-i18nUpgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs24-npmUpgrade nodejs24-docsUpgrade nodejs24-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejs24-libs-debuginfoUpgrade nodejs-full-i18nUpgrade npm | Jul 7, 2026 | Jun 17, 2026 |
| Rocky_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs24-debuginfoUpgrade nodejs24-debugsourceUpgrade nodejs24-full-i18nUpgrade nodejs-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-libsUpgrade nodejs24-libsUpgrade nodejsUpgrade nodejs24-develUpgrade nodejs24-libs-debuginfoUpgrade v8-13.6-develUpgrade nodejs24 | Jul 13, 2026 | Jul 7, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub