Cross-Origin Request Routing in Undici's Socks5ProxyAgent

CVE-2026-6734

What is CVE-2026-6734?

The vulnerability arises from the Socks5ProxyAgent in Undici, which improperly manages a single connection pool for multiple origins. This behavior leads to cross-origin request routing, where requests or credentials intended for one origin are sent to another, potentially exposing sensitive data and downgrading HTTPS requests to HTTP without user knowledge. Applications utilizing Socks5ProxyAgent to connect to various origins could face significant risks. Users are advised to upgrade to Undici versions 7.26.0 or 8.2.0 for resolution and can implement a separate instance of Socks5ProxyAgent for each origin as a workaround.

References