Vulnerability details
CVE-2026-6734
undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse
Official description
Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination. This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP. Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin. This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0. Patches: Upgrade to undici v7.26.0 or v8.2.0. Workarounds: Use a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (openjs) | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Red Hat | OpenShift Pipelines | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Build of Podman Desktop | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Self-service automation portal 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Self-service automation portal 2 | All | CVEProject cvelistV5 (CNA) |
| undici | undici | 7.23.0 ≤ v < 7.26.0 | CVEProject cvelistV5 (CNA) |
| undici | undici | 8.0.0 ≤ v < 8.2.0 | CVEProject cvelistV5 (CNA) |
References and advisories
23- https://github.com/nodejs/undici/security/advisories/GHSA-hm92-r4w5-c3mj
- https://cna.openjsf.org/security-advisories.html
- https://access.redhat.com/security/cve/CVE-2026-6734 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2490024 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6734.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:48151 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:35841 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:39868 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:35891 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34342 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36754 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41929 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:38236 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7378 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22380 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22934 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:65126 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60520 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:48124 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36820 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:56431 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:56366 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:57013 vendor-advisoryx_refsource_REDHAT
Details
- Published
- 2026-06-17
- Last updated
- 2026-09-10
- State
- Published
- Assigner (CNA)
- openjs
Exploit prediction (EPSS)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-346Origin Validation Error
- CWE-940Improper Verification of Source of a Communication Channel