CVE-2026-9697: undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
Impact
undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings.
Applications that pin to an internal or corporate CA via requestTls.ca will, when their proxy URI is SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed by any publicly-trusted CA for the target hostname is accepted, breaking the intended pin and enabling MITM read and tamper of the HTTPS exchange.
Affected applications are those that use undici's ProxyAgent (or Socks5ProxyAgent directly) with SOCKS5 AND rely on requestTls for TLS scope restriction. The bug was introduced in undici 7.23.0 when SOCKS5 support was added.
Patches
Upgrade to undici v7.28.0 or v8.5.0.
Workarounds
No workaround is available within the SOCKS5 path. If a SOCKS5 proxy with TLS scope restriction is required and an upgrade is not yet possible, route the traffic through an HTTP-proxy ProxyAgent instead, where requestTls is honored correctly.
Other sources
Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings.
Applications that pin to an internal or corporate CA via requestTls.ca will, when their proxy URI is SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed by any publicly-trusted CA for the target hostname is accepted, breaking the intended pin and enabling MITM read and tamper of the HTTPS exchange.
Affected applications are those that use undici's ProxyAgent (or Socks5ProxyAgent directly) with SOCKS5 AND rely on requestTls for TLS scope restriction. The bug was introduced in undici 7.23.0 when SOCKS5 support was added.
Patches: Upgrade to undici v7.28.0 or v8.5.0.
Workarounds: No workaround is available within the SOCKS5 path. If a SOCKS5 proxy with TLS scope restriction is required and an upgrade is not yet possible, route the traffic through an HTTP-proxy ProxyAgent instead, where requestTls is honored correctly.
— NVD
undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 8.5.0 - Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 7.28.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.17.0-1 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 7.28.0 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 8.5.0 - Compensating control
If a SOCKS5 proxy with TLS scope restriction is required and an upgrade is not yet possible, route the traffic through an HTTP-proxy ProxyAgent instead (HTTP-proxy ProxyAgent where requestTls is honored correctly), rather than using undici ProxyAgent/Socks5ProxyAgent over socks5:// or socks://.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9697?
CVE-2026-9697 has a severity score of 7.4, classified as high.
How does CVE-2026-9697 affect undici's ProxyAgent functionality?
CVE-2026-9697 causes undici's ProxyAgent to drop the requestTls option when used with a SOCKS5 proxy, which may lead to TLS certificate validation bypass.
What impact does CVE-2026-9697 have on HTTPS connections?
CVE-2026-9697 allows HTTPS connections to default to Node's trust store, ignoring critical user-provided certificate configurations.
How can I mitigate the risks associated with CVE-2026-9697?
To mitigate CVE-2026-9697, avoid using SOCKS5 proxies with undici's ProxyAgent if TLS certificate validation is required.
When was CVE-2026-9697 published?
CVE-2026-9697 was published on June 17, 2026.