CVE-2026-9697 Overview
CVE-2026-9697 is a certificate validation vulnerability [CWE-295] in undici, the HTTP/1.1 client used by Node.js. When ProxyAgent is configured with a SOCKS5 URI (socks5:// or socks://), the library silently drops the requestTls option. The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings. The bug was introduced in undici 7.23.0 when SOCKS5 support was added.
Critical Impact
Applications that pin to an internal or corporate Certificate Authority (CA) lose their pin and accept any certificate signed by a publicly-trusted CA, enabling man-in-the-middle (MITM) read and tamper of HTTPS traffic.
Affected Products
- undici versions 7.23.0 through versions prior to 7.28.0
- undici 8.x versions prior to 8.5.0
- Node.js applications using ProxyAgent or Socks5ProxyAgent with SOCKS5 and requestTls
Discovery Timeline
- 2026-06-17 - CVE-2026-9697 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-9697
Vulnerability Analysis
The undici library exposes a ProxyAgent that lets callers tunnel HTTPS through a proxy while supplying TLS material for the inner connection via the requestTls option. Callers use requestTls to scope trust to an internal CA, enforce client certificates, or pin a server name. When the proxy URI scheme is socks5:// or socks://, the SOCKS5 transport path does not propagate requestTls to the inner TLS handshake. The handshake proceeds with Node's default TLS configuration and the bundled Mozilla CA store as the trust anchor.
The outcome is a silent downgrade of the trust model. The application code is unchanged and the API call returns success, yet the certificate validation policy the developer intended is not enforced.
Root Cause
The SOCKS5 dispatcher added in undici 7.23.0 omits the option-forwarding logic that the HTTP proxy dispatcher uses. The requestTls payload never reaches the tls.connect() call that wraps the SOCKS5 stream. Custom ca, cert, key, rejectUnauthorized, and servername values are discarded before the TLS context is built.
Attack Vector
An attacker positioned between the SOCKS5 proxy and the target server presents a certificate issued by any publicly trusted CA for the target hostname. The victim client validates the certificate against the default Mozilla bundle, accepts it, and completes the handshake. The attacker can then read and modify the HTTPS exchange in transit. Exploitation requires a network position to intercept TLS traffic and a valid certificate for the target hostname from any publicly trusted CA, raising attack complexity but leaving confidentiality and integrity exposed.
No verified public exploit code is available. See the GitHub Security Advisory GHSA-vmh5-mc38-953g for the maintainer's technical write-up.
Detection Methods for CVE-2026-9697
Indicators of Compromise
- Outbound HTTPS connections from Node.js processes that succeed despite the server presenting a certificate not chained to the pinned internal CA.
- TLS handshakes from node processes negotiated against unexpected Server Name Indication (SNI) values when SOCKS5 routing is in use.
- Application logs showing successful API calls to internal endpoints that should have failed certificate validation under the configured pin.
Detection Strategies
- Inventory package-lock.json and yarn.lock files for undici versions between 7.23.0 and 7.27.x, or 8.0.0 through 8.4.x.
- Audit application code for ProxyAgent or Socks5ProxyAgent constructed with a socks5:// or socks:// URI and a non-empty requestTls block.
- Run integration tests that point a SOCKS5 client at a server presenting a certificate signed by a public CA and assert that the connection is rejected when an internal CA is pinned.
Monitoring Recommendations
- Capture TLS handshake metadata at the egress proxy and alert on certificates issued by public CAs for hostnames expected to use the internal Public Key Infrastructure (PKI).
- Forward Node.js application logs and TLS error events into a centralized analytics platform and baseline expected certificate issuers per destination.
- Track Software Bill of Materials (SBOM) drift for the undici package across build pipelines and container images.
How to Mitigate CVE-2026-9697
Immediate Actions Required
- Upgrade undici to version 7.28.0 or 8.5.0 in all direct and transitive dependencies.
- Rebuild and redeploy container images and serverless bundles that ship undici so the patched version reaches runtime.
- Rotate any secrets, tokens, or credentials transmitted over SOCKS5-tunneled HTTPS during the exposure window if MITM cannot be ruled out.
Patch Information
The maintainers fixed the option-propagation defect in undici v7.28.0 and v8.5.0. Both releases forward requestTls through the SOCKS5 dispatcher to the inner TLS handshake. Refer to the GitHub Security Advisory GHSA-vmh5-mc38-953g and the OpenJS Foundation Security Advisories for release notes and commit references.
Workarounds
- Route traffic through an HTTP-proxy ProxyAgent instead of a SOCKS5 ProxyAgent, since the HTTP path honors requestTls correctly.
- Avoid SOCKS5 proxies entirely until the package is upgraded if TLS scope restriction is a security requirement.
- Terminate TLS at a trusted forward proxy that performs internal CA validation, then connect to that proxy from the Node.js application.
# Upgrade undici to a patched release
npm install undici@^7.28.0
# or
npm install undici@^8.5.0
# Verify resolved version across the dependency tree
npm ls undici
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
