SOCKS5 Proxy Configuration Issue in Undici's ProxyAgent

CVE-2026-9697

What is CVE-2026-9697?

A vulnerability in Undici's ProxyAgent allows the requestTls option to be disregarded when using a SOCKS5 proxy. This flaw permits fallback to the default trust store, compromising the application's TLS scope restrictions. Consequently, any certificate from a publicly-trusted CA can be accepted, which may lead to a Man-in-the-Middle (MITM) scenario, allowing unauthorized interception and tampering of HTTPS traffic. This issue affects versions from 7.23.0 onward, and a proper fix can be achieved by upgrading to versions 7.28.0 or 8.5.0. Workarounds are limited, with the recommended approach of using an HTTP-proxy ProxyAgent to ensure requestTls configurations are honored.

References