Skip to content
Fencer Vulns
high 7.5

CVE-2026-6734 json

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

published 2026-06-17 4 mo ago modified 2026-09-10 59 d ago also GHSA-hm92-r4w5-c3mj , EUVD-2026-37760

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 28%
public exploits
0
none known

Summary

Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination.

This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP.

Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin.

This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0.

Patches: Upgrade to undici v7.26.0 or v8.2.0.

Workarounds: Use a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.

Patch / fix

  • npm undici 7.28.0, 8.2.0
  • undici undici 7.26.0, 8.2.0
  • Red Hat Cryostat 4 on RHEL 9 4.2.0-13
  • Red Hat Red Hat Enterprise Linux 10 1:24.18.0-1.el10_2
  • Red Hat Red Hat Enterprise Linux 8 8100020260630152626.6d880403
  • Red Hat Red Hat Enterprise Linux 9 9080020260626074955.rhel9
  • Red Hat Cluster Observability Operator 1.5.0 1782838476, 1782838753, 1782839193, 1782839494, 1782839658, 1782839981, 1782840519, 1782841925, 1782844225
  • Red Hat Red Hat Developer Hub 1.10 1783448184
  • Red Hat Red Hat Developer Hub 1.9 1784210921
  • Red Hat Red Hat Hardened Images 1.96.0-1.hum1, 24.18.0-0.3.hum1, 25.9.0-1.1.hum1, 26.3.0-1.2.hum1
  • Red Hat Red Hat OpenShift AI 2.25 1787801527
  • Red Hat Red Hat OpenShift AI 3.4 1787121387
  • Red Hat Red Hat Openshift Data Foundation 4.18 1786705347, 1786705558, 1786705646, 1786705741, 1786705777, 1786705802, 1786705938, 1786706101, 1786706125, 1786706138, 1786706177, 1786706188, 1786706357, 1786706577, 1786706612, 1786706644, 1786706659, 1786706679, 1786706880
  • Red Hat Red Hat Openshift Data Foundation 4.19 1786701555, 1786701839, 1786702052, 1786702264, 1786702276, 1786702315, 1786702440, 1786702448, 1786702559, 1786702563, 1786702623, 1786702636, 1786702713, 1786702716, 1786702872, 1786702917, 1786702949, 1786703071, 1786703137, 1786703143
  • Red Hat Red Hat Openshift Data Foundation 4.20 1786626399, 1786627106, 1786627382, 1786627430, 1786627460, 1786627469, 1786627559, 1786628053, 1786628142, 1786628235, 1786628340, 1786628623, 1786629076, 1786629478, 1786629761, 1786631508, 1786632256, 1786644072, 1786687918, 1786688215
  • Red Hat Red Hat OpenShift Dev Spaces 3.29 1782498792, 1782989367, 1783007534, 1785245777
  • node-undici Debian 14 8.5.0+dfsg+~cs3.2.0-1

debian advisories DEBIAN-CVE-2026-6734

  • npm RHEL 8 1:11.16.0-1.24.18.0.1.module+el8.10.0+24481+7a71fac8
  • nodejs RHEL 8 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
  • nodejs-libs RHEL 8 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
  • nodejs-nodemon RHEL 8 3.0.3-1.module+el8.10.0+24190+49a46c75
  • nodejs-full-i18n RHEL 8 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
  • nodejs-packaging RHEL 8 2021.06-6.module+el8.10.0+24190+49a46c75
  • nodejs-packaging-bundler RHEL 8 2021.06-6.module+el8.10.0+24190+49a46c75
  • nodejs24 hummingbird 1 24.18.0-0.3.hum1

red hat advisories RHSA-2026:39868RHSA-2026:38236RHSA-2026:35891RHSA-2026:35841RHSA-2026:22934RHSA-2026:22380

  • npm AlmaLinux 8 1:11.16.0-1.24.18.0.1.module_el8.10.0+4228+2938bc94
  • nodejs AlmaLinux 8 1:24.18.0-1.module_el8.10.0+4228+2938bc94
  • nodejs-libs AlmaLinux 8 1:24.18.0-1.module_el8.10.0+4228+2938bc94
  • nodejs-nodemon AlmaLinux 8 3.0.3-1.module_el8.10.0+4061+f8ceeab9
  • nodejs-full-i18n AlmaLinux 8 1:24.18.0-1.module_el8.10.0+4228+2938bc94
  • nodejs-packaging AlmaLinux 8 2021.06-6.module_el8.10.0+4086+70facd4a
  • nodejs-packaging-bundler AlmaLinux 8 2021.06-6.module_el8.10.0+4086+70facd4a
  • nodejs24 AlmaLinux 10 1:24.18.0-1.el10_2

almalinux advisories ALSA-2026:39868ALSA-2026:35841ALSA-2026:35891

  • nodejs Rocky Linux 8 1:24.18.0-1.module+el8.10.0+40252+a58646bc
  • nodejs-nodemon Rocky Linux 8 3.0.3-1.module+el8.10.0+2084+ab509703
  • nodejs-packaging Rocky Linux 8 2021.06-6.module+el8.10.0+40171+8fa9c325
  • nodejs-packaging Rocky Linux 8 2021.06-6.module+el8.10.0+40172+38f6fdd1
  • nodejs-packaging Rocky Linux 8 2021.06-6.module+el8.10.0+40048+6d99f608
  • nodejs24 Rocky Linux 10 1:24.18.0-1.el10_2
  • nodejs-nodemon Rocky Linux 9 3.0.3-3.module+el9.7.0+40025+0e0cf6b2
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.7.0+40153+4d595597

rocky linux advisories RLSA-2026:39868RLSA-2026:35841RLSA-2026:35891

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-6734 updated cvss 7.5

undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing

  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-console-plugin-rhel9, openshift-pipelines/pipelines-console-plugin-pf5-rhel9 Red Hat Build of Podman Desktop rh-podman-desktop.git Red Hat Self-service automation portal 2 ansible-automation-platform/automation-portal, ansible-automation-platform/bootc-automation-portal-rhel9
    affected: workaround, no fix available
  • Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/logging-console-plugin-rhel9 1782841925, cluster-observability-operator/monitoring-console-plugin-rhel9 1782838476, cluster-observability-operator/monitoring-console-plugin-pf5-rhel9 1782844225, cluster-observability-operator/monitoring-console-plugin-pf6-rhel9 1782839658, cluster-observability-operator/distributed-tracing-console-plugin-rhel9 1782838753, cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9 1782839494, +3 more
    fixed: vendor fix RHSA-2026:34342
  • Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9 4.2.0-13
    fixed: vendor fix RHSA-2026:48151
  • Red Hat Developer Hub 1.9 rhdh/rhdh-hub-rhel9 1784210921
    fixed: vendor fix RHSA-2026:41929
  • Red Hat Developer Hub 1.10 rhdh/rhdh-hub-rhel9 1783448184
    fixed: vendor fix RHSA-2026:36754
  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 24.18.0-1.module+el8.10.0+24481+7a71fac8, nodejs-libs 24.18.0-1.module+el8.10.0+24481+7a71fac8, nodejs-nodemon 3.0.3-1.module+el8.10.0+24190+49a46c75, npm 11.16.0-1.24.18.0.1.module+el8.10.0+24481+7a71fac8, nodejs-full-i18n 24.18.0-1.module+el8.10.0+24481+7a71fac8, nodejs-packaging 2021.06-6.module+el8.10.0+24190+49a46c75, +1 more
    fixed: vendor fix RHSA-2026:39868
  • Red Hat Enterprise Linux AppStream (v. 9) nodejs 24.18.0-1.module+el9.8.0+24456+b244c3b4, nodejs-libs 24.18.0-1.module+el9.8.0+24456+b244c3b4, nodejs-nodemon 3.0.3-3.module+el9.8.0+24355+35d95b59, npm 11.16.0-1.24.18.0.1.module+el9.8.0+24456+b244c3b4, nodejs-full-i18n 24.18.0-1.module+el9.8.0+24456+b244c3b4, nodejs-packaging 2021.06-6.module+el9.8.0+24355+35d95b59, +1 more
    fixed: vendor fix RHSA-2026:35891
  • Red Hat Enterprise Linux AppStream (v. 10) nodejs24 24.18.0-1.el10_2, nodejs24-libs 24.18.0-1.el10_2, nodejs24-full-i18n 24.18.0-1.el10_2, nodejs24-npm 11.16.0-1.24.18.0.1.el10_2
    fixed: vendor fix RHSA-2026:35841
show 17 more
  • Red Hat Hardened Images rust 1.96.0-1.hum1, cargo 1.96.0-1.hum1, clippy 1.96.0-1.hum1, rustfmt 1.96.0-1.hum1, rust-gdb 1.96.0-1.hum1, rust-src 1.96.0-1.hum1, +29 more
    fixed: vendor fix RHSA-2026:22934
  • Red Hat OpenShift AI 2.25 rhoai/odh-dashboard-rhel9 1791853525, rhoai/odh-mod-arch-model-registry-rhel9 1791853432, rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 1787801527
    fixed: vendor fix RHSA-2026:87410
  • Red Hat OpenShift AI 3.3 rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 1790013905
    fixed: vendor fix RHSA-2026:73987
  • Red Hat OpenShift AI 3.4 rhoai/odh-dashboard-rhel9 1791861020, rhoai/odh-mod-arch-maas-rhel9 1791860708, rhoai/odh-mod-arch-automl-rhel9 1791861032, rhoai/odh-mod-arch-gen-ai-rhel9 1791861479, rhoai/odh-mod-arch-autorag-rhel9 1791860994, rhoai/odh-mod-arch-eval-hub-rhel9 1791861214, +2 more
    fixed: vendor fix RHSA-2026:84734
  • Red Hat Openshift Data Foundation 4.18 odf4/cephcsi-rhel9 1786705347, odf4/odf-cli-rhel9 1786705938, odf4/mcg-core-rhel9 1786705558, odf4/odf-console-rhel9 1786706577, odf4/mcg-rhel9-operator 1786705646, odf4/ocs-rhel9-operator 1786705802, +13 more
    fixed: vendor fix RHSA-2026:56431
  • Red Hat Openshift Data Foundation 4.19 odf4/cephcsi-rhel9 1786701839, odf4/odf-cli-rhel9 1786702440, odf4/mcg-core-rhel9 1786702052, odf4/odf-console-rhel9 1786703071, odf4/mcg-rhel9-operator 1786702559, odf4/ocs-rhel9-operator 1786702276, +14 more
    fixed: vendor fix RHSA-2026:56366
  • Red Hat Openshift Data Foundation 4.20 odf4/cephcsi-rhel9 1786627460, odf4/odf-cli-rhel9 1786628142, odf4/mcg-core-rhel9 1786628235, odf4/odf-console-rhel9 1786628053, odf4/mcg-rhel9-operator 1786627106, odf4/ocs-rhel9-operator 1786629478, +16 more
    fixed: vendor fix RHSA-2026:57013
  • Red Hat OpenShift Dev Spaces 3.29 devspaces/code-rhel9 1785245777, devspaces/openvsx-rhel9 1783007534, devspaces/dashboard-rhel9 1782498792, devspaces/pluginregistry-rhel9 1782989367
    fixed: vendor fix RHSA-2026:48124
  • Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/perses-rhel9 1782839109, cluster-observability-operator/thanos-rhel9 1782840280, cluster-observability-operator/korrel8r-rhel9 1782839157, cluster-observability-operator/prometheus-rhel9 1782840780, cluster-observability-operator/alertmanager-rhel9 1782840761, cluster-observability-operator/perses-rhel9-operator 1782839191, +10 more
    not affected: vulnerable code not present
  • Red Hat Cryostat 4 undici, cryostat-openshift-console-plugin-npm
    not affected: component not present
  • Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-rhel9 4.2.0-13, cryostat/cryostat-db-rhel9 4.2.0-19, cryostat/jfr-datasource-rhel9 4.2.0-13, cryostat/cryostat-reports-rhel9 4.2.0-13, cryostat/cryostat-storage-rhel9 4.2.0-19, cryostat/cryostat-rhel9-operator 4.2.0-18, +3 more
    not affected: vulnerable code not present
  • Red Hat AMQ Broker 7 undici
    not affected: component not present
  • Red Hat Developer Hub 1.9 rhdh/rhdh-rhel9-operator 1784210575, rhdh/rhdh-operator-bundle 1784215493 Red Hat Developer Hub 1.10 rhdh/rhdh-rhel9-operator 1783447707, rhdh/rhdh-operator-bundle 1783453583, rhdh/rhdh-must-gather-rhel9 1783447888, rhdh/rhdh-rag-content-rhel9 1783446803 Red Hat Enterprise Linux 8 npm, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, nodejs-packaging, +1 more Red Hat Enterprise Linux 9 npm, nodejs, nodejs-libs, nodejs-full-i18n Red Hat Enterprise Linux 10 nodejs22 Red Hat Hardened Images v8-14.1-devel 14.1.146.11-1.25.9.0.1.1.hum1, v8-14.6-devel 14.6.202.34-1.26.3.0.1.2.hum1, v8-13.6-devel 13.6.233.17-1.24.18.0.0.3.hum1
    not affected: vulnerable code not present
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-mod-arch-mlflow-rhel9
    not affected: component not present
  • Red Hat OpenShift AI 2.25 rhoai/odh-rhel9-operator 1788331391, rhoai/odh-rhel9-operator 1792570619, rhoai/odh-vllm-cpu-rhel9 1786712073, rhoai/odh-vllm-cpu-rhel9 1792018436, rhoai/odh-dashboard-rhel9 1788312226, rhoai/odh-modelmesh-rhel9 1788319539, +140 more Red Hat OpenShift AI 3.3 rhoai/odh-cli-rhel9 1790070206, rhoai/rhai-cli-rhel9 1790070206, rhoai/odh-mlflow-rhel9 1789653606, rhoai/odh-trainer-rhel9 1790136369, rhoai/odh-maas-api-rhel9 1790131842, rhoai/odh-mlserver-rhel9 1789121365, +76 more Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1787330837, rhoai/odh-cli-rhel9 1791509689, rhoai/rhai-cli-rhel9 1787330837, rhoai/rhai-cli-rhel9 1791509689, rhoai/odh-automl-rhel9 1786612415, rhoai/odh-automl-rhel9 1791535789, +198 more
    not affected: vulnerable code not present
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console-rhel9, openshift4/ose-monitoring-plugin-rhel9, openshift4/ose-agent-installer-ui-rhel9
    not affected: vulnerable code not in execute path
  • Red Hat OpenShift Container Platform 5 openshift5/ose-console-rhel9, openshift5/ose-agent-installer-ui-rhel9 Red Hat Openshift Data Foundation 4.18 odf4/mcg-operator-bundle 1786708633, odf4/ocs-operator-bundle 1786708778, odf4/odf-operator-bundle 1786709119, odf4/cephcsi-operator-bundle 1786708508, odf4/odr-hub-operator-bundle 1786709184, odf4/rook-ceph-operator-bundle 1786709254, +7 more Red Hat Openshift Data Foundation 4.19 odf4/mcg-operator-bundle 1786705806, odf4/ocs-operator-bundle 1786706032, odf4/odf-operator-bundle 1786706375, odf4/cephcsi-operator-bundle 1786705694, odf4/odr-hub-operator-bundle 1786706461, odf4/rook-ceph-operator-bundle 1786706507, +7 more Red Hat Openshift Data Foundation 4.20 odf4/mcg-operator-bundle 1786689758, odf4/ocs-operator-bundle 1786689936, odf4/odf-operator-bundle 1786690288, odf4/cephcsi-operator-bundle 1786689641, odf4/odr-hub-operator-bundle 1786690447, odf4/rook-ceph-operator-bundle 1786690533, +8 more Red Hat OpenShift Dev Spaces 3.29 devspaces/udi-rhel9 1782991491, devspaces/udi-rhel9 1784927049, devspaces/code-rhel9 1782498475, devspaces/server-rhel9 1783033397, devspaces/server-rhel9 1784887425, devspaces/openvsx-rhel9 1784982910, +24 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
4 mo ago

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
npm undici
>=7.23.0, <7.28.0
>=8.0.0, <8.2.0
7.28.0
8.2.0

Affected products

  • undici undici
  • Red Hat Cryostat 4 on RHEL 9
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Cluster Observability Operator 1.5.0
  • Red Hat Red Hat Developer Hub 1.10
  • Red Hat Red Hat Developer Hub 1.9
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat OpenShift AI 2.25
  • Red Hat Red Hat OpenShift AI 3.4
  • Red Hat Red Hat Openshift Data Foundation 4.18
  • Red Hat Red Hat Openshift Data Foundation 4.19
  • Red Hat Red Hat Openshift Data Foundation 4.20
  • Red Hat Red Hat OpenShift Dev Spaces 3.29
  • Red Hat Cryostat 4
  • Red Hat OpenShift Pipelines
  • Red Hat Red Hat AMQ Broker 7
  • Red Hat Red Hat Build of Podman Desktop
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Self-service automation portal 2

Classification

Weakness
  • CWE-346 Origin Validation Error
  • CWE-940 Improper Verification of Source of a Communication Channel

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.