CVE-2026-6734: undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

Synopsis

Cross-origin request routing is a logic flaw in the undici HTTP client library affecting versions 7.23.0 through 7.25.x and 8.0.0 through 8.1.0. The vulnerability is reachable over the network and requires a low-privilege account, but no victim interaction. When exploited, an attacker can cause credentials and request bodies meant for one origin to be sent to a different origin, trust responses from the wrong server, and silently downgrade HTTPS connections to HTTP. Patched-image rebuilds at versions 7.26.0 and 8.2.0 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the vulnerable service over the network; the CVSS vector specifies AV:N, meaning no local or physical access is needed.

• AuthenticationRequired

  A low-privilege account is sufficient; the CVSS vector specifies PR:L, so the attacker must hold at least minimal authenticated access to the application.

• Victim interactionNot required

  No user action is needed to trigger the misrouting; the CVSS vector specifies UI:N, meaning exploitation can occur without any social engineering.

• Attack complexityDetail

  The CVSS vector specifies AC:H, meaning exploitation depends on specific environmental conditions, such as the application making requests to more than one origin through a shared Socks5ProxyAgent instance.

Blast Radius

• An attacker causes credentials (headers, tokens, cookies) intended for a target origin to be transmitted to a different, attacker-accessible origin.
• Request bodies containing sensitive data are delivered to the wrong server, exposing that data to whoever controls the receiving origin.
• The attacker receives and can act on responses from the misrouted origin, allowing it to inject fabricated response data back into the application.
• HTTPS requests are silently sent as plain HTTP, stripping transport-layer confidentiality and exposing the full request and response to network observers.