undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
Summary
| CVE | CVE-2026-9697 |
|---|---|
| State | PUBLISHED |
| Assigner | openjs |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-06-17 18:18:06 UTC |
| Updated | 2026-08-24 13:19:21 UTC |
| Description | Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings. Applications that pin to an internal or corporate CA via requestTls.ca will, when their proxy URI is SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed by any publicly-trusted CA for the target hostname is accepted, breaking the intended pin and enabling MITM read and tamper of the HTTPS exchange. Affected applications are those that use undici's ProxyAgent (or Socks5ProxyAgent directly) with SOCKS5 AND rely on requestTls for TLS scope restriction. The bug was introduced in undici 7.23.0 when SOCKS5 support was added. Patches: Upgrade to undici v7.28.0 or v8.5.0. Workarounds: No workaround is available within the SOCKS5 path. If a SOCKS5 proxy with TLS scope restriction is required and an upgrade is not yet possible, route the traffic through an HTTP-proxy ProxyAgent instead, where requestTls is honored correctly. |
Risk And Classification
Primary CVSS: v3.1 7.4 HIGH from ADP
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS: 0.002770000 probability, percentile 0.194180000 (date 2026-06-26)
Problem Types: CWE-295 | CWE-295 CWE-295: Improper Certificate Validation | CWE-295 Improper Certificate Validation
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ADP | CVSS | 7.4 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
| 3.1 | ce714d77-add3-4f53-aff5-83d477b104bb | Secondary | 7.4 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
| 3.1 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | Secondary | 7.4 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
| 3.1 | CNA | CVSS | 7.4 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
HighPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
NoneCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Undici | Undici | affected 7.23.0 7.28.0 semver | Not specified |
| CNA | Undici | Undici | unaffected 7.28.0 semver | Not specified |
| CNA | Undici | Undici | affected 8.0.0 8.5.0 semver | Not specified |
| CNA | Undici | Undici | unaffected 8.5.0 semver | Not specified |
| ADP | Red Hat | Cryostat 4 On RHEL 9 | unaffected 4.2.0-13 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 10 | unaffected 1:24.18.0-1.el10_2 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 8 | unaffected 8100020260630152626.6d880403 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 9 | unaffected 9080020260626074955.rhel9 * rpm | Not specified |
| ADP | Red Hat | Cluster Observability Operator 1.5.0 | unaffected 1782840519 * rpm | Not specified |
| ADP | Red Hat | Cluster Observability Operator 1.5.0 | unaffected 1782839981 * rpm | Not specified |
| ADP | Red Hat | Cluster Observability Operator 1.5.0 | unaffected 1782839193 * rpm | Not specified |
| ADP | Red Hat | Cluster Observability Operator 1.5.0 | unaffected 1782838753 * rpm | Not specified |
| ADP | Red Hat | Cluster Observability Operator 1.5.0 | unaffected 1782841925 * rpm | Not specified |
| ADP | Red Hat | Cluster Observability Operator 1.5.0 | unaffected 1782844225 * rpm | Not specified |
| ADP | Red Hat | Cluster Observability Operator 1.5.0 | unaffected 1782839658 * rpm | Not specified |
| ADP | Red Hat | Cluster Observability Operator 1.5.0 | unaffected 1782838476 * rpm | Not specified |
| ADP | Red Hat | Cluster Observability Operator 1.5.0 | unaffected 1782839494 * rpm | Not specified |
| ADP | Red Hat | Red Hat Developer Hub 1.10 | unaffected 1783448184 * rpm | Not specified |
| ADP | Red Hat | Red Hat Developer Hub 1.9 | unaffected 1784210921 * rpm | Not specified |
| ADP | Red Hat | Red Hat Hardened Images | unaffected 26.3.0-1.2.hum1 * rpm | Not specified |
| ADP | Red Hat | Red Hat Hardened Images | unaffected 1.96.0-1.hum1 * rpm | Not specified |
| ADP | Red Hat | Red Hat Hardened Images | unaffected 24.18.0-0.3.hum1 * rpm | Not specified |
| ADP | Red Hat | Red Hat Hardened Images | unaffected 25.9.0-1.1.hum1 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4.16 | unaffected 1783306396 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4.17 | unaffected 1784744859 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786705347 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706101 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786705558 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786705646 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706138 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786705741 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786705777 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786705802 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786705938 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706577 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706125 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706177 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706188 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706679 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706357 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706612 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706644 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706659 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706880 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786701839 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786701555 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702052 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702559 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702713 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702264 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702448 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702276 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702440 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702315 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786703071 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702563 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702636 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702623 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786703137 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702716 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702872 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702949 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702917 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786703143 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786627460 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786626399 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786628235 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786627106 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786629761 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786627559 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786687918 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786629478 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786628142 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786631508 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786628053 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786627382 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786627430 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786629076 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786627469 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786644072 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786688215 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786628340 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786628623 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786632256 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786628935 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786629548 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Dev Spaces 3.29 | unaffected 1782498792 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Dev Spaces 3.29 | unaffected 1783007534 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Dev Spaces 3.29 | unaffected 1782989367 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Dev Spaces 3.29 | unaffected 1785245777 * rpm | Not specified |
| ADP | Red Hat | Cryostat 4 | Not specified | Not specified |
| ADP | Red Hat | Cryostat 4 | Not specified | Not specified |
| ADP | Red Hat | OpenShift Pipelines | Not specified | Not specified |
| ADP | Red Hat | OpenShift Pipelines | Not specified | Not specified |
| ADP | Red Hat | OpenShift Pipelines | Not specified | Not specified |
| ADP | Red Hat | Red Hat AMQ Broker 7 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Build Of Podman Desktop | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 10 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 8 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 9 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4 | Not specified | Not specified |
| ADP | Red Hat | Self-service Automation Portal 2 | Not specified | Not specified |
| ADP | Red Hat | Self-service Automation Portal 2 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2026:47728 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| cna.openjsf.org/security-advisories.html | ce714d77-add3-4f53-aff5-83d477b104bb | cna.openjsf.org | Vendor Advisory |
| access.redhat.com/errata/RHSA-2026:7378 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:57013 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36621 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:22380 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:35891 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | bugzilla.redhat.com | |
| access.redhat.com/errata/RHSA-2026:34342 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36754 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| github.com/nodejs/undici/security/advisories/GHSA-vmh5-mc38-953g | ce714d77-add3-4f53-aff5-83d477b104bb | github.com | Mitigation, Vendor Advisory |
| access.redhat.com/errata/RHSA-2026:22934 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9697.json | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | security.access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:35841 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/security/cve/CVE-2026-9697 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:39868 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:41929 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:38236 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36820 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:56366 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:48124 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:48151 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:56431 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: tonghuaroot (en)
CNA: UlisesGascon (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| ADP | 2026-06-17T19:03:30.813Z | Reported to Red Hat. |
| ADP | 2026-06-17T16:46:42.706Z | Made public. |
Solutions
ADP: RHSA-2026:48151: Cryostat 4 on RHEL 9
ADP: RHSA-2026:35841: Red Hat Enterprise Linux AppStream (v. 10)
ADP: RHSA-2026:39868: Red Hat Enterprise Linux AppStream (v. 8)
ADP: RHSA-2026:35891: Red Hat Enterprise Linux AppStream (v. 9)
ADP: RHSA-2026:34342: Cluster Observability Operator 1.5.0
ADP: RHSA-2026:36754: Red Hat Developer Hub 1.10
ADP: RHSA-2026:41929: Red Hat Developer Hub 1.9
ADP: RHSA-2026:38236: Red Hat Hardened Images
ADP: RHSA-2026:7378: Red Hat Hardened Images
ADP: RHSA-2026:22380: Red Hat Hardened Images
ADP: RHSA-2026:22934: Red Hat Hardened Images
ADP: RHSA-2026:36621: Red Hat OpenShift Container Platform 4.16
ADP: RHSA-2026:47728: Red Hat OpenShift Container Platform 4.17
ADP: RHSA-2026:48124: Red Hat OpenShift Dev Spaces 3.29
ADP: RHSA-2026:36820: Red Hat OpenShift Dev Spaces 3.29
ADP: RHSA-2026:56431: Red Hat Openshift Data Foundation 4.18
ADP: RHSA-2026:56366: Red Hat Openshift Data Foundation 4.19
ADP: RHSA-2026:57013: Red Hat Openshift Data Foundation 4.2
Workarounds
ADP: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
There are currently no legacy QID mappings associated with this CVE.