CVE catalog

CVE-2026-6734

Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched

[CVE catalog]

Severity: High · CVSS 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: Apr 10, 2026, 1:03:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.34% · Oct 25, 2026

Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination. This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP. Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin. This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0. Patches: Upgrade to undici v7.26.0 or v8.2.0. Workarounds: Use a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	node-undici	sid	`8.12.2+dfsg+~cs3.2.3-2`	fixed
Debian	node-undici	forky	`8.10.2+dfsg+~cs3.2.2-1`	fixed
Debian	node-undici	trixie	`7.3.0+dfsg1+~cs24.12.11-1`	vulnerable
Debian	node-undici	bookworm	`5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4`	not affected
Debian	node-undici	bookworm-security	`5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3`	not affected
Cpe	undici	Not reported	`7.28.0`	fixed
Cpe	undici	Not reported	`8.2.0`	fixed
Cpe	undici	Not reported	`8.2.0`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	node-undici	source	sid	`8.5.0+dfsg+~cs3.2.0-1`	not yet assigned	Not reported	[1140363]
Debian	node-undici	source	forky	`8.5.0+dfsg+~cs3.2.0-1`	not yet assigned	Not reported	[1140363]
Debian	node-undici	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1140363]
Debian	node-undici	source	bookworm	`Not affected`	unimportant	Not reported	[1140363]
Cpe	undici	cpe	Not reported	`7.28.0`	Not reported	Not reported	Not reported
Cpe	undici	cpe	Not reported	`8.2.0`	Not reported	Not reported	Not reported
Cpe	undici	cpe	Not reported	`8.2.0`	Not reported	NVD-CVE-2026-6734	Not reported

[Debian bug #1140363]

Notes

[trixie] node-undici: Minor issue

OpenFactory catalog packages

[Debian 13 (Trixie)]

[libllhttp9.2]Affected
Source package: [node-undici]
Details (2)
- 9.2.1~7.3.0+dfsg1+~cs24.12.11-1 · amd64 · trixie
  Affected
  nvd · node-undici · debian · 13
- 9.2.1~7.3.0+dfsg1+~cs24.12.11-1 · arm64 · trixie
  Affected
  nvd · node-undici · debian · 13
[libllhttp-dev]Affected
Source package: [node-undici]
Details (2)
- 9.2.1~7.3.0+dfsg1+~cs24.12.11-1 · amd64 · trixie
  Affected
  nvd · node-undici · debian · 13
- 9.2.1~7.3.0+dfsg1+~cs24.12.11-1 · arm64 · trixie
  Affected
  nvd · node-undici · debian · 13
[node-llhttp]Affected
Source package: [node-undici]
Details (2)
- 9.2.1~7.3.0+dfsg1+~cs24.12.11-1 · all · trixie
  Affected
  nvd · node-undici · debian · 13
- 9.2.1~7.3.0+dfsg1+~cs24.12.11-1 · all · trixie
  Affected
  nvd · node-undici · debian · 13
[node-undici]Affected
Details (2)
- 7.3.0+dfsg1+~cs24.12.11-1 · all · trixie
  Affected
  nvd · node-undici · debian · 13
- 7.3.0+dfsg1+~cs24.12.11-1 · all · trixie
  Affected
  nvd · node-undici · debian · 13

[Debian 12 (Bookworm)]

[node-llhttp]Not affected
Source package: [node-undici]
Details (4)
- 8.1.0~5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4 · all · bookworm
  Not affected
  nvd · node-undici · debian · bookworm
- 8.1.0~5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4 · all · bookworm
  Not affected
  nvd · node-undici · debian · bookworm
- 8.1.0~5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3 · all · bookworm-security
  Not affected
  nvd · node-undici · debian · bookworm
- 8.1.0~5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3 · all · bookworm-security
  Not affected
  nvd · node-undici · debian · bookworm
[node-undici]Not affected
Details (4)
- 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4 · all · bookworm
  Not affected
  nvd · node-undici · debian · bookworm
- 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4 · all · bookworm
  Not affected
  nvd · node-undici · debian · bookworm
- 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3 · all · bookworm-security
  Not affected
  nvd · node-undici · debian · bookworm
- 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3 · all · bookworm-security
  Not affected
  nvd · node-undici · debian · bookworm

Observed: Oct 23, 2026, 10:34:23 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]