GHSA-hm92-r4w5-c3mj

Suggest an improvement
Source
https://github.com/advisories/GHSA-hm92-r4w5-c3mj
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-hm92-r4w5-c3mj/GHSA-hm92-r4w5-c3mj.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-hm92-r4w5-c3mj
Aliases
  • CVE-2026-6734
Downstream
Related
Published
2026-06-19T14:20:20Z
Modified
2026-06-20T22:59:14.587299607Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse
Details

Impact

When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination.

This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP.

Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin.

This was introduced in undici 7.23.0 via #4385 and affects all versions through 8.1.0.

Patches

Upgrade to undici v7.28.0 or v8.2.0

Workarounds

Use a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.

Database specific 
{
    "nvd_published_at": "2026-06-17T18:18:05Z",
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-19T14:20:20Z",
    "cwe_ids": [
        "CWE-346"
    ],
    "severity": "HIGH"
}
References

Affected packages

npm / undici

Package

Name
undici
View open source insights on deps.dev
Purl
pkg:npm/undici

Affected ranges

Type
SEMVER
Events
Introduced
7.23.0
Fixed
7.28.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-hm92-r4w5-c3mj/GHSA-hm92-r4w5-c3mj.json"

npm / undici

Package

Name
undici
View open source insights on deps.dev
Purl
pkg:npm/undici

Affected ranges

Type
SEMVER
Events
Introduced
8.0.0
Fixed
8.2.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-hm92-r4w5-c3mj/GHSA-hm92-r4w5-c3mj.json"