{"id":"CVE-2026-9697","aliases":["GHSA-vmh5-mc38-953g"],"url":"https://o3.security/vulnerability/CVE-2026-9697","summary":"undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent","details":"## Impact\n\nundici's `ProxyAgent` silently drops the `requestTls` option when configured with a SOCKS5 proxy URI (`socks5://` or `socks://`). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured `ca`, `cert`, `key`, `rejectUnauthorized`, and `servername` settings.\n\nApplications that pin to an internal or corporate CA via `requestTls.ca` will, when their proxy URI is SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed by any publicly-trusted CA for the target hostname is accepted, breaking the intended pin and enabling MITM read and tamper of the HTTPS exchange.\n\nAffected applications are those that use undici's `ProxyAgent` (or `Socks5ProxyAgent` directly) with SOCKS5 AND rely on `requestTls` for TLS scope restriction. The bug was introduced in undici 7.23.0 when SOCKS5 support was added.\n\n## Patches\n\nUpgrade to undici v7.28.0 or v8.5.0.\n\n## Workarounds\n\nNo workaround is available within the SOCKS5 path. If a SOCKS5 proxy with TLS scope restriction is required and an upgrade is not yet possible, route the traffic through an HTTP-proxy `ProxyAgent` instead, where `requestTls` is honored correctly.","published":"2026-06-17T16:46:42.706Z","modified":"2026-10-21T02:30:21.204858835Z","cvss":{"score":7.4,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"},"epss":{"score":0.00459,"percentile":0.38602,"asOf":"2026-09-12"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"undici","fixedVersion":"7.28.0"},{"ecosystem":"npm","name":"undici","fixedVersion":"8.5.0"}],"fix":null,"references":[{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9697.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22380"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22934"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34342"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:35841"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:35891"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36621"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36754"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36820"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:38236"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:39868"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41929"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:47728"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:48124"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:48151"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:56366"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:56431"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:57013"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:60520"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:65126"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:7378"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-9697"},{"type":"ADVISORY","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9697.json"},{"type":"ADVISORY","url":"https://github.com/nodejs/undici/security/advisories/GHSA-vmh5-mc38-953g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9697"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490018"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:30:21.204858835Z"}}