{"record":{"id":"8f3b71a00ed17903","repo":"nodejs/node","slug":"und-err-socks5-auth-version","errorCode":"UND_ERR_SOCKS5_AUTH_VERSION","errorMessage":"Invalid auth sub-negotiation version: ${version}","messagePattern":"Invalid auth sub-negotiation version: (.+?)","errorType":"exception","errorClass":"Socks5ProxyError","httpStatus":null,"severity":"error","filePath":"deps/undici/src/lib/core/socks5-client.js","lineNumber":258,"sourceCode":"    request[2 + usernameBuffer.length] = passwordBuffer.length\n    passwordBuffer.copy(request, 3 + usernameBuffer.length)\n\n    this.socket.write(request)\n  }\n\n  /**\n   * Handle authentication response\n   */\n  handleAuthResponse () {\n    if (this.buffer.length < 2) {\n      return // Not enough data yet\n    }\n\n    const version = this.buffer[0]\n    const status = this.buffer[1]\n\n    if (version !== 0x01) {\n      throw new Socks5ProxyError(`Invalid auth sub-negotiation version: ${version}`, 'UND_ERR_SOCKS5_AUTH_VERSION')\n    }\n\n    if (status !== 0x00) {\n      throw new Socks5ProxyError('Authentication failed', 'UND_ERR_SOCKS5_AUTH_FAILED')\n    }\n\n    this.buffer = this.buffer.subarray(2)\n    debug('authentication successful')\n    this.markAuthenticated()\n  }\n\n  /**\n   * Send CONNECT command\n   * @param {string} address - Target address (IP or domain)\n   * @param {number} port - Target port\n   */\n  connect (address, port) {\n    if (this.state === STATES.CONNECTING || this.state === STATES.CONNECTED) {","sourceCodeStart":240,"sourceCodeEnd":276,"githubUrl":"https://github.com/nodejs/node/blob/1b2de5e052fc0fb95fd7fb6846dcec4ade598e9e/deps/undici/src/lib/core/socks5-client.js#L240-L276","documentation":"Thrown in handleAuthResponse() when the first byte of the username/password auth reply is not 0x01. RFC 1929 fixes the sub-negotiation version at 0x01; any other value indicates a non-conformant server or protocol desynchronization (e.g. leftover bytes from the method-selection reply being parsed as the auth reply).","triggerScenarios":"Server does not follow RFC 1929 and uses a different version byte; buffer desync where handleAuthResponse reads bytes belonging to a different phase; a SOCKS5 server that skipped the auth sub-negotiation.","commonSituations":"Buggy/incomplete SOCKS5 server; framing bug causing stale bytes in this.buffer; proxy that proxies GSSAPI but was negotiated as USERNAME_PASSWORD.","solutions":["Verify the proxy implements RFC 1929 username/password auth correctly.","Check that the client correctly consumed the prior handshake reply (buffer framing).","Reconnect on a fresh socket to rule out desync from a partial earlier read.","Capture the exchange with a packet trace to confirm the server's reply byte."],"exampleFix":"// no caller-side config fixes a non-conformant server;\n// verify with a known-good proxy and a packet capture:\n//   expected server reply: 01 00  (VER=1, STATUS=success)","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { /* wait for auth response */ } catch (e) {\n  if (e.code === 'UND_ERR_SOCKS5_AUTH_VERSION') {\n    // server is not RFC 1929 compliant or buffers desynced; reconnect fresh\n  } else throw e\n}","preventionTips":["Ensure prior reply bytes are fully consumed before the next phase parses.","Test against a reference RFC 1929 server.","Capture a packet trace to confirm the server's auth reply byte."],"tags":["socks5","proxy","authentication","protocol","rfc-1929"],"backgroundTag":null,"analyzedSha":"1b2de5e052fc0fb95fd7fb6846dcec4ade598e9e","analyzedAt":"2026-08-13T00:53:24.642Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}