{"@context":"https://openvex.dev/ns/v0.2.0","@id":"https://database.harborguard.co/cve/CVE-2026-9697/vex.json","author":"HarborGuard Database","role":"Document Creator","timestamp":"2026-06-17T18:34:54.144Z","version":1,"tooling":"HarborGuard Database (https://database.harborguard.co)","statements":[{"vulnerability":{"name":"CVE-2026-9697","@id":"https://www.cve.org/CVERecord?id=CVE-2026-9697","description":"Impact:\nundici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings.\n\nApplications that pin to an internal or corporate CA via requestTls.ca will, when their proxy URI is SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed "},"products":[{"@id":"cpe:2.3:a:undici:undici:*:*:*:*:*:*:*:*","identifiers":{"cpe23":"cpe:2.3:a:undici:undici:*:*:*:*:*:*:*:*"}}],"status":"affected","action_statement":"Update to a fixed version: 7.28.0, 8.5.0.","timestamp":"2026-06-17T18:34:54.144Z"}]}