Log in Start free

Vulnerability · Published Jun 17, 2026 · Assigned by openjs

CVE-2026-9697undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

High 7.4

In plain English

A high-severity improper certificate validation in undici from undici. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.5%top 60.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings. Applications that pin to an internal or corporate CA via requestTls.ca will, when their proxy URI is SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed by any publicly-trusted CA for the target hostname is accepted, breaking the intended pin and enabling MITM read and tamper of the HTTPS exchange. Affected applications are those that use undici's ProxyAgent (or Socks5ProxyAgent directly) with SOCKS5 AND rely on requestTls for TLS scope restriction. The bug was introduced in undici 7.23.0 when SOCKS5 support was added. Patches: Upgrade to undici v7.28.0 or v8.5.0. Workarounds: No workaround is available within the SOCKS5 path. If a SOCKS5 proxy with TLS scope restriction is required and an upgrade is not yet possible, route the traffic through an HTTP-proxy ProxyAgent instead, where requestTls is honored correctly.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8nodejs1:24.18.0-1.module_el8.10.0+4228+2938bc94ALSA-2026:39868
AlmaLinux:9nodejs1:24.18.0-1.module_el9.8.0+277+61fc613eALSA-2026:35891
AlmaLinux:8nodejs-devel1:24.18.0-1.module_el8.10.0+4228+2938bc94ALSA-2026:39868
AlmaLinux:9nodejs-devel1:24.18.0-1.module_el9.8.0+277+61fc613eALSA-2026:35891
AlmaLinux:8nodejs-docs1:24.18.0-1.module_el8.10.0+4228+2938bc94ALSA-2026:39868
AlmaLinux:9nodejs-docs1:24.18.0-1.module_el9.8.0+277+61fc613eALSA-2026:35891
AlmaLinux:8nodejs-full-i18n1:24.18.0-1.module_el8.10.0+4228+2938bc94ALSA-2026:39868
AlmaLinux:9nodejs-full-i18n1:24.18.0-1.module_el9.8.0+277+61fc613eALSA-2026:35891
AlmaLinux:8nodejs-libs1:24.18.0-1.module_el8.10.0+4228+2938bc94ALSA-2026:39868
AlmaLinux:9nodejs-libs1:24.18.0-1.module_el9.8.0+277+61fc613eALSA-2026:35891
AlmaLinux:8nodejs-nodemon3.0.3-1.module_el8.10.0+4061+f8ceeab9ALSA-2026:39868
AlmaLinux:9nodejs-nodemon3.0.3-3.module_el9.7.0+209+ecf6523eALSA-2026:35891
AlmaLinux:8nodejs-packaging2021.06-6.module_el8.10.0+4086+70facd4aALSA-2026:39868
AlmaLinux:9nodejs-packaging2021.06-6.module_el9.7.0+209+ecf6523eALSA-2026:35891
AlmaLinux:8nodejs-packaging-bundler2021.06-6.module_el8.10.0+4086+70facd4aALSA-2026:39868
AlmaLinux:9nodejs-packaging-bundler2021.06-6.module_el9.7.0+209+ecf6523eALSA-2026:35891
AlmaLinux:10nodejs241:24.18.0-1.el10_2ALSA-2026:35841
AlmaLinux:10nodejs24-devel1:24.18.0-1.el10_2ALSA-2026:35841
AlmaLinux:10nodejs24-docs1:24.18.0-1.el10_2ALSA-2026:35841
AlmaLinux:10nodejs24-full-i18n1:24.18.0-1.el10_2ALSA-2026:35841
AlmaLinux:10nodejs24-libs1:24.18.0-1.el10_2ALSA-2026:35841
AlmaLinux:10nodejs24-npm1:11.16.0-1.24.18.0.1.el10_2ALSA-2026:35841
AlmaLinux:8npm1:11.16.0-1.24.18.0.1.module_el8.10.0+4228+2938bc94ALSA-2026:39868
AlmaLinux:9npm1:11.16.0-1.24.18.0.1.module_el9.8.0+277+61fc613eALSA-2026:35891
AlmaLinux:8v8-13.6-devel3:13.6.233.17-1.24.18.0.1.module_el8.10.0+4228+2938bc94ALSA-2026:39868
AlmaLinux:9v8-13.6-devel3:13.6.233.17-1.24.18.0.1.module_el9.8.0+277+61fc613eALSA-2026:35891
Debian:13node-undicino fix listedDEBIAN-CVE-2026-9697
Debian:14node-undici8.5.0+dfsg+~cs3.2.0-1DEBIAN-CVE-2026-9697
Rocky Linux:8nodejs1:24.18.0-1.module+el8.10.0+40252+a58646bcRLSA-2026:39868
Rocky Linux:8nodejs-nodemon0:3.0.3-1.module+el8.10.0+2084+ab509703RLSA-2026:39868
Rocky Linux:9nodejs-nodemon0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2RLSA-2026:35891
Rocky Linux:8nodejs-packaging0:2021.06-6.module+el8.10.0+40171+8fa9c325RLSA-2026:39868
Rocky Linux:8nodejs-packaging0:2021.06-6.module+el8.10.0+40172+38f6fdd1RLSA-2026:39868
Rocky Linux:8nodejs-packaging0:2021.06-6.module+el8.10.0+40048+6d99f608RLSA-2026:39868
Rocky Linux:9nodejs-packaging0:2021.06-6.module+el9.7.0+40052+e32ea525RLSA-2026:35891
Rocky Linux:9nodejs-packaging0:2021.06-6.module+el9.7.0+40165+d075e3f2RLSA-2026:35891
Rocky Linux:9nodejs-packaging0:2021.06-6.module+el9.7.0+40153+4d595597RLSA-2026:35891
Rocky Linux:10nodejs241:24.18.0-1.el10_2RLSA-2026:35841
Ubuntu:24.04:LTSnode-undicino fix listedUBUNTU-CVE-2026-9697
Ubuntu:25.10node-undicino fix listedUBUNTU-CVE-2026-9697
Ubuntu:26.04:LTSnode-undicino fix listedUBUNTU-CVE-2026-9697
Ubuntu:26.10node-undicino fix listedUBUNTU-CVE-2026-9697
npmundici7.28.0GHSA-vmh5-mc38-953g
npmundici8.5.0GHSA-vmh5-mc38-953g

Affected products (as reported)

VendorProductVersions
undici undici 7.23.0 – before 7.28.08.0.0 – before 8.5.0

Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References