Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination.
This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP.
Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin.
This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0.
Patches: Upgrade to undici v7.26.0 or v8.2.0.
Workarounds: Use a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-develUpgrade v8-13.6-develUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-libsUpgrade nodejs-full-i18n | Jul 7, 2026 | Jul 6, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs24-npmUpgrade nodejs24Upgrade nodejs24-libsUpgrade nodejs24-full-i18nUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-develUpgrade nodejs24-debuginfoUpgrade nodejs24-debugsourceUpgrade v8-13.6-develUpgrade nodejs24-docs | Jul 8, 2026 | Jun 17, 2026 |
| Redhat_linux | — | Upgrade nodejs-nodemonUpgrade nodejs24-debuginfoUpgrade nodejs-libsUpgrade npmUpgrade nodejs24-docsUpgrade nodejs24-npmUpgrade nodejs-full-i18nUpgrade nodejs24-libs-debuginfoUpgrade nodejs-docsUpgrade v8-13.6-develUpgrade nodejs-debuginfoUpgrade nodejs24-full-i18nUpgrade nodejs24-develUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs24Upgrade nodejs-packaging-bundlerUpgrade nodejs24-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejs24-libsUpgrade nodejsUpgrade nodejs-packaging | Jul 7, 2026 | Jun 17, 2026 |
| Rocky_linux | — | Upgrade nodejs24-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs24-libs-debuginfoUpgrade nodejs-develUpgrade v8-13.6-develUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs24-libsUpgrade nodejs24-develUpgrade nodejs24Upgrade nodejs-full-i18nUpgrade nodejs24-debugsourceUpgrade nodejs24-full-i18nUpgrade nodejs-debugsource | Jul 13, 2026 | Jul 7, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub