PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9697 undici CVE debrief

CVE-2026-9697 is a high-severity vulnerability (CVSS score of 7.4) affecting undici's ProxyAgent when used with SOCKS5 proxy URIs. The issue causes the requestTls option to be silently dropped, leading to a fallback to Node's default trust store. This can result in unintended trust anchor changes, allowing for potential MITM attacks. The vulnerability was introduced in undici version 7.23.0 and can be mitigated by upgrading to version 7.28.0 or 8.5.0. Applications using undici's ProxyAgent or Socks5ProxyAgent with SOCKS5 and relying on requestTls for TLS scope restriction are affected. No workarounds are available, but an alternative is to route traffic through an HTTP-proxy ProxyAgent.

Vendor
undici
Product
Unknown
CVSS
HIGH 7.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-09-10
Advisory published
2026-06-17
Advisory updated
2026-09-10

Who should care

Developers and administrators using undici's ProxyAgent or Socks5ProxyAgent with SOCKS5 proxy URIs and relying on requestTls for TLS scope restriction should be aware of this vulnerability. This includes applications that pin to an internal or corporate CA via requestTls.ca, as they may be vulnerable to MITM attacks.

Technical summary

The vulnerability occurs when undici's ProxyAgent is configured with a SOCKS5 proxy URI (socks5:// or socks://). In this case, the requestTls option is silently dropped, causing the target HTTPS connection through the SOCKS5 tunnel to fall back to Node's default trust store. This ignores user-configured ca, cert, key, rejectUnauthorized, and servername settings. As a result, applications that rely on requestTls for TLS scope restriction may be compromised, allowing for potential MITM read and tamper of the HTTPS exchange.

Defensive priority

High

Recommended defensive actions

  • Upgrade to undici version 7.28.0 or 8.5.0 to patch the vulnerability.
  • Route traffic through an HTTP-proxy ProxyAgent as an alternative to SOCKS5.
  • Review and update applications that use undici's ProxyAgent or Socks5ProxyAgent with SOCKS5 and rely on requestTls for TLS scope restriction.
  • Monitor for potential MITM attacks and unusual traffic patterns.
  • Implement additional security measures, such as certificate pinning and strict TLS verification.

Evidence notes

The vulnerability was introduced in undici version 7.23.0 when SOCKS5 support was added. The issue is confirmed by the OpenJSF and Node.js communities. [ref-4](https://cna.openjsf.org/security-advisories.html) and [ref-5](https://github.com/nodejs/undici/security/advisories/GHSA-vmh5-mc38-953g) provide additional information on the vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9697 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9697

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9697 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9697

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://cna.openjsf.org/security-advisories.html

    ce714d77-add3-4f53-aff5-83d477b104bb

  • Source reference

    Unverified legacy reference

    URL: https://github.com/nodejs/undici/security/advisories/GHSA-vmh5-mc38-953g

    ce714d77-add3-4f53-aff5-83d477b104bb

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.