undici reuses a single connection pool for all origins when the Socks5ProxyAgent is used, failing to validate that the pool matches the intended target. As a result, requests meant for one origin are routed to another, sending credentials and request payloads to an unauthorized server and accepting responses from the wrong source. HTTPS requests may also be silently downgraded to HTTP, exposing data to eavesdropping.

The vulnerability affects the undici library, specifically versions 7.23.0 through 8.1.0. Any application that imports undici and uses Socks5ProxyAgent or sets it globally to make HTTP or HTTPS requests to multiple distinct origins is at risk.

The CVSS score of 7.5 indicates a high severity. The EPSS score is below 1 %, signifying very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers must exploit client software that employs the shared Socks5ProxyAgent; therefore, the risk primarily lies with misconfigured or vulnerable applications rather than a widespread public exploitation vector.