CVE-2026-6734 undici CVE debrief

Who should care

Defenders of applications using undici library, specifically those using Socks5ProxyAgent and making requests to multiple origins, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-6734 is a high-severity vulnerability in undici library, affecting versions 7.23.0 through 8.1.0, causing cross-origin request routing and potential credential and data exposure. Defenders should prioritize upgrading to undici v7.26.0 or v8.2.0, or implementing workarounds.

• Potential credential exposure due to cross-origin request routing
• Potential data exposure due to cross-origin request routing
• Silent downgrading of HTTPS requests to HTTP
• Verification of affected versions and remediation priority

Technical summary

The vulnerability causes cross-origin request routing when using Socks5ProxyAgent, leading to potential credential and data exposure, as well as silent downgrading of HTTPS requests to HTTP. This affects applications that use Socks5ProxyAgent and make requests to more than one origin. The issue is caused by reusing a single connection pool across different origins without verifying the pool's origin matches the requested origin. This results in credentials and request data intended for one origin being sent to another, and responses from the wrong origin being trusted. The vulnerability was introduced in undici 7.23.0 and affects all versions through 8.1.0.

Defensive priority

Defenders should prioritize upgrading to undici v7.26.0 or v8.2.0, or implementing workarounds such as using a separate Socks5ProxyAgent instance per origin.

Recommended defensive actions

• Upgrade to undici v7.26.0 or v8.2.0
• Use a separate Socks5ProxyAgent instance per origin
• Avoid using Socks5ProxyAgent with multiple origins
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The vulnerability was introduced in undici 7.23.0 and affects all versions through 8.1.0. The issue is caused by reusing a single connection pool across different origins without verifying the pool's origin matches the requested origin.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.