Executive brief
Undici is a popular HTTP client for Node.js used to fetch data from the web. A security flaw in its proxy component causes it to ignore custom security settings (like private certificates) when using a SOCKS5 proxy. This could allow an attacker to intercept or modify sensitive encrypted traffic by presenting a certificate from a standard public authority that the application was specifically configured to reject.
Technical details
A vulnerability exists in undici's ProxyAgent (and Socks5ProxyAgent) where the 'requestTls' configuration object is ignored when a SOCKS5 proxy URI (socks5:// or socks://) is used. This causes the client to fall back to the default Node.js trust store, ignoring user-specified 'ca', 'cert', 'key', and 'rejectUnauthorized' settings. An attacker positioned to perform a Man-in-the-Middle (MITM) attack can bypass certificate pinning or private CA restrictions by presenting any certificate signed by a publicly-trusted CA. The issue was introduced in version 7.23.0 and is fixed in versions 7.28.0 and 8.5.0.
Affected products
- Node.js undici >= 7.23.0, < 7.28.0; >= 8.0.0, < 8.5.0
Timeline
- 2026-06-17: disclosed
- 2026-06-17: advisory
- 2026-06-17: patched