CVE-2026-6734 Overview
CVE-2026-6734 is a high-severity origin validation flaw in undici, the HTTP client library used by Node.js. When applications configure Socks5ProxyAgent, undici reuses a single connection pool across multiple origins without verifying that the pool's origin matches the requested origin. All outbound requests are dispatched through the pool established for the first origin, regardless of the intended destination host.
The weakness maps to [CWE-346: Origin Validation Error]. It was introduced in undici 7.23.0 through PR #4385 and affects every release up to and including 8.1.0.
Critical Impact
Credentials and request bodies intended for origin B can be sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP.
Affected Products
- undici versions 7.23.0 through 7.25.x
- undici versions 8.0.0 through 8.1.0
- Node.js applications using Socks5ProxyAgent directly or via setGlobalDispatcher
Discovery Timeline
- 2026-06-17 - CVE-2026-6734 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-6734
Vulnerability Analysis
The Socks5ProxyAgent dispatcher in undici maintains an internal connection pool to tunnel HTTP requests through a SOCKS5 proxy. The agent should key its pools by the destination origin, ensuring that a request to https://api-b.example does not reuse a tunnel that was established to reach https://api-a.example. The vulnerable implementation skips this check and returns the first pool that was created, regardless of which origin the caller requested.
As a result, the application unknowingly speaks to the wrong server. Authorization headers, session cookies, API keys, and POST bodies are transmitted to an unintended host. The response received from that host is then treated as authoritative for the requested origin, enabling response substitution attacks. Because the cached pool was opened with the first origin's scheme, an HTTPS request issued later can be transported over an HTTP tunnel, silently downgrading transport security.
Root Cause
The regression was introduced in undici 7.23.0 via PR #4385, which changed how Socks5ProxyAgent constructs and caches its dispatcher pool. The code path stores a single pool reference at agent scope rather than indexing pools by {origin, protocol}. Subsequent dispatch() calls bypass any origin comparison and reuse the cached pool. This is a classic origin validation error [CWE-346].
Attack Vector
Exploitation requires that a vulnerable application use Socks5ProxyAgent to send requests to more than one origin. An attacker who controls or compromises the first origin reached through the agent receives all subsequent requests, including those intended for sensitive backends. The flaw can also be triggered passively when a benign first origin causes credentials destined for a second origin to be exposed in plaintext over an unintended channel. See the GitHub Security Advisory GHSA-hm92-r4w5-c3mj for the maintainer write-up.
Detection Methods for CVE-2026-6734
Indicators of Compromise
- Outbound TLS or HTTP sessions from Node.js processes to unexpected destinations after a Socks5ProxyAgent is initialized.
- Application logs showing responses whose Host, certificate subject, or content does not match the requested URL.
- Unexplained HTTP traffic where HTTPS was expected from services that proxy through SOCKS5.
Detection Strategies
- Inventory Node.js services and identify dependencies on undici versions 7.23.0 through 8.1.0 using software composition analysis.
- Grep application source and lockfiles for Socks5ProxyAgent and setGlobalDispatcher usage combined with calls to multiple origins.
- Inspect egress proxy logs for a single SOCKS5 tunnel carrying requests addressed to multiple distinct hostnames.
Monitoring Recommendations
- Alert on Node.js workloads that establish unexpected outbound connections after dependency updates.
- Capture and review TLS SNI versus HTTP Host header mismatches at the network egress point.
- Track dependency drift on undici and Node.js runtimes that bundle it, and gate deployments on advisory checks.
How to Mitigate CVE-2026-6734
Immediate Actions Required
- Upgrade undici to version 7.26.0 or 8.2.0, which restore per-origin pool keying.
- Audit applications for Socks5ProxyAgent usage and confirm all callers run on the patched release.
- Rotate any credentials, tokens, or cookies that may have been dispatched to an unintended origin since 7.23.0 was deployed.
Patch Information
The undici maintainers released fixes in undici v7.26.0 and v8.2.0. Both versions reintroduce origin checks before returning a cached dispatcher pool. Refer to the OpenJS Foundation Advisories and the GitHub Security Advisory GHSA-hm92-r4w5-c3mj for the canonical patch references.
Workarounds
- Instantiate a separate Socks5ProxyAgent per destination origin rather than sharing one globally.
- Avoid calling setGlobalDispatcher with a Socks5ProxyAgent when the application contacts multiple origins.
- Pin undici to a pre-7.23.0 release until the fixed version can be deployed, after validating compatibility.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
