{"record":{"id":"b69998f19590fcd0","repo":"nodejs/node","slug":"und-err-socket","errorCode":"UND_ERR_SOCKET","errorMessage":"bad connect","messagePattern":"bad connect","errorType":"exception","errorClass":"SocketError","httpStatus":null,"severity":"error","filePath":"deps/undici/src/lib/api/api-connect.js","lineNumber":48,"sourceCode":"    this.abort = null\n\n    addSignal(this, signal)\n  }\n\n  onRequestStart (controller, context) {\n    if (this.reason) {\n      controller.abort(this.reason)\n      return\n    }\n\n    assert(this.callback)\n\n    this.abort = (reason) => controller.abort(reason)\n    this.context = context\n  }\n\n  onResponseStart () {\n    throw new SocketError('bad connect', null)\n  }\n\n  onRequestUpgrade (controller, statusCode, headers, socket) {\n    const { callback, opaque, context } = this\n\n    removeSignal(this)\n\n    this.callback = null\n\n    let responseHeaders = headers\n    const rawHeaders = controller?.rawHeaders\n    // Indicates is an HTTP2Session\n    if (responseHeaders != null) {\n      responseHeaders = this.responseHeaders === 'raw'\n        ? util.parseRawHeaders(rawHeaders)\n        : headers\n    }\n","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/nodejs/node/blob/1b2de5e052fc0fb95fd7fb6846dcec4ade598e9e/deps/undici/src/lib/api/api-connect.js#L30-L66","documentation":"Thrown as a SocketError (code UND_ERR_SOCKET) by ConnectHandler.onResponseStart. undici.connect issues an HTTP CONNECT request expecting a 101 Switching Protocols upgrade (handled by onRequestUpgrade). If the server responds with a normal HTTP response instead of an upgrade, onResponseStart fires and undici throws 'bad connect' — the tunnel was never established. This is a protocol/server-level failure, not an argument error.","triggerScenarios":"Calling undici.connect against a target that does not support CONNECT tunneling: the upstream returned a regular HTTP response (200/4xx/5xx) instead of a 101 upgrade. Common when connecting directly to an origin server (not a proxy), or when a proxy refuses the CONNECT (e.g. 407 auth required, 403 forbidden).","commonSituations":"Using connect() as if it were a raw TCP socket to an origin (it requires a proxy that speaks CONNECT); proxy requires auth/allowlist not configured; TLS origin rejecting CONNECT; intermediary (corporate proxy/firewall) returning an HTML error page.","solutions":["Point connect() at an HTTP proxy that supports CONNECT, not directly at the origin server.","If a proxy is required, authenticate via Proxy-Authorization or configure allowlisting on the proxy.","For raw TLS to an origin, use undici request/stream with an https URL or a dedicated Client instead of connect().","Inspect the response status/headers from the intermediary to diagnose the refused tunnel."],"exampleFix":"// before: connecting directly to origin (no CONNECT support)\nundici.connect({ path: 'api.example.com:443' }, cb)   // server returns 200 -> 'bad connect'\n// after: tunnel through a CONNECT-capable proxy\nundici.connect({ path: 'api.example.com:443', dispatcher: new undici.ProxyAgent('http://proxy:3128') }, cb)","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"undici.connect({ path: target, dispatcher: proxyAgent }, (err, { socket }) => {\n  if (err && err.code === 'UND_ERR_SOCKET' && /bad connect/.test(err.message)) {\n    console.error('CONNECT rejected by upstream — point connect() at a CONNECT-capable proxy')\n    return\n  }\n  if (err) throw err\n  // use socket\n})","preventionTips":["Use connect() only against CONNECT-capable HTTP proxies.","For raw TLS to an origin, use undici.Client/request with an https URL instead of connect().","Ensure proxy auth and allowlisting are configured.","Inspect intermediary responses (407/403) before retrying."],"tags":["undici","connect","tunnel","proxy","socket","network","protocol"],"backgroundTag":null,"analyzedSha":"1b2de5e052fc0fb95fd7fb6846dcec4ade598e9e","analyzedAt":"2026-08-13T00:53:24.642Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}