CVE-2026-6734Disclosure(nodejs / undici)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch nodejs undici systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination. This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP. Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin. This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0. Patches: Upgrade to undici v7.26.0 or v8.2.0. Workarounds: Use a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.

nodejs CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-346CWE-940

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

undici

Threat summary

Patch or workaround signal is available
7 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 6 signals
Disclosure: 4 classified signals
Peaked 3d ago at 3 mentions (2026-06-17); latest day: 1
7 total mentions across 4 days

Affected systems

Vendors

nodejs

Products

undici

Deep dive

Activity timeline7 mentions / 4d

Signal classification2 categories

Disclosure

457.1%

Patch

342.9%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-17	3	Disclosure2Patch1
2026-06-18	2	Disclosure1Patch1
2026-06-19	1	Disclosure1
2026-06-22	1	Patch1

Full discourse7 posts

Matteo Collina@matteocollina91d
Patch
🟠 High: SOCKS5 cross-origin routing (CVE-2026-6734). Socks5ProxyAgent reused one connection pool across origins without checking the origin matched. Requests/credentials could go to the wrong destination. Fixed in 7.28.0 / 8.2.0.
Post summary
The text discloses CVE-2026-6734, explaining that a connection‑pool reuse flaw caused cross‑origin routing, and it notes the patch available in versions 7.28.0 and 8.2.0.
10020300
57.8K followersView on X
Daily CyberSecurity@the_yellow_fall88d
Patch
Four undici vulnerabilities (CVE-2026-6734, CVE-2026-9697) affect the Node.js HTTP client, which sees 133M weekly downloads. Update undici now. #undici #NodeJS #npm #SOCKS5 #WebSocket #AppSec #Vulnerability https://securityonline.info/undici-vulnerabilities https://t.co/MIpNFukQaw
Post summary
The tweet announces four undici CVEs affecting the Node.js HTTP client and urges users to update the library immediately, implying a patch is available.
01010557
12.3K followersView on X
Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters90d
Disclosure
#CVE-2026-6734 - #Undici Socks5ProxyAgent flaw. Cross-origin request routing: credentials leak, wrong origin trusted, HTTPS downgrade possible. #CVSS 7.5. No patch yet. Review usage immediately. #NodeJS #infosec #linux #python #ubuntu More detailed info: https://www.valtersit.com/cve/CVE-2026-6734
Post summary
The post announces CVE‑2026‑6734, describing a cross‑origin request routing flaw that could leak credentials and allow HTTPS downgrades, with a CVSS score of 7.5, but provides no PoC, exploit code, active exploitation evidence, or patch information.
0000050
948 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds91d
Disclosure
CVE-2026-6734 Cross-Origin Request Routing Vulnerability in Undici Socks5ProxyAgent https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6734
Post summary
A headline indicates a cross‑origin request routing vulnerability (CVE-2026-6734) in the Undici Socks5ProxyAgent, offering minimal technical detail without exploitation or remediation information.
0000051
4.1K followersView on X
Infoflowcloud@infoflowcloud92d
Disclosure
🚨*CVE* CVE-2026-6734 Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested orig… https://www.cve.org/CVERecord?id=CVE-2026-6734 ----- Traducción: Impacto de CVE-20… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑6734, detailing a connection‑pool reuse flaw in undici’s Socks5ProxyAgent, but offers no PoC, exploit, patch, or evidence of active attacks.
0000033
82 followersView on X
CVE@CVEnew92d
Disclosure
CVE-2026-6734 Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested orig… https://www.cve.org/CVERecord?id=CVE-2026-6734
Post summary
The text links to CVE‑2026‑6734, describing a connection‑pool reuse flaw in undici’s Socks5ProxyAgent that lacks origin verification. No PoC, exploit, patch, or active exploitation is mentioned.
00000205
57.6K followersView on X
Ulises Gascón@kom_25692d
Patch
🚨 High-severity security fix in undici (7.26.0, 8.2.0) just released! Patches CVE-2026-6734. undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse. https://github.com/nodejs/undici/security/advisories/GHSA-hm92-r4w5-c3mj
Post summary
Node.js "undici" package releases version 7.26.0 and 8.2.0 to patch CVE‑2026‑6734, which could allow cross‑origin request routing through reused SOCKS5 proxies. The advisory link provides further vendor details.
00000102
5.5K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	nodejs	undici	-	node.js	-

Explore more

Back to dashboard nodejs CVEs undici vulnerabilities

What researchers are saying

CVE-2026-6734

Matteo Collina[verified]@matteocollinaPatch

The text discloses CVE-2026-6734, explaining that a connection‑pool reuse flaw caused cross‑origin routing, and it notes the patch available in versions 7.28.0 and 8.2.0.

Hugo | DevOps | Cybersecurity 🇱🇻[verified]@HugoValtersDisclosure

The post announces CVE‑2026‑6734, describing a cross‑origin request routing flaw that could leak credentials and allow HTTPS downgrades, with a CVSS score of 7.5, but provides no PoC, exploit code, active exploitation evidence, or patch information.

Daily CyberSecurity@the_yellow_fallPatch

The tweet announces four undici CVEs affecting the Node.js HTTP client and urges users to update the library immediately, implying a patch is available.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A headline indicates a cross‑origin request routing vulnerability (CVE-2026-6734) in the Undici Socks5ProxyAgent, offering minimal technical detail without exploitation or remediation information.

Infoflowcloud@infoflowcloudDisclosure

The post announces CVE‑2026‑6734, detailing a connection‑pool reuse flaw in undici’s Socks5ProxyAgent, but offers no PoC, exploit, patch, or evidence of active attacks.

CVE@CVEnewDisclosure

The text links to CVE‑2026‑6734, describing a connection‑pool reuse flaw in undici’s Socks5ProxyAgent that lacks origin verification. No PoC, exploit, patch, or active exploitation is mentioned.

Ulises Gascón@kom_256Patch

Node.js "undici" package releases version 7.26.0 and 8.2.0 to patch CVE‑2026‑6734, which could allow cross‑origin request routing through reused SOCKS5 proxies. The advisory link provides further vendor details.