nodejs/node · error · Socks5ProxyError

UND_ERR_SOCKS5_AUTH_METHOD

UND_ERR_SOCKS5_AUTH_METHOD

Error message

Unsupported authentication method: ${method}

What it means

Thrown in handleHandshakeResponse when the server selected an auth method the client recognizes as neither NO_AUTH (0x00) nor USERNAME_PASSWORD (0x02). The client only implements those two methods (RFC 1928 + RFC 1929); any other selection is unsupported.

Source

Thrown at deps/undici/src/lib/core/socks5-client.js:207

    if (version !== SOCKS_VERSION) {
      throw new Socks5ProxyError(`Invalid SOCKS version: ${version}`, 'UND_ERR_SOCKS5_VERSION')
    }

    if (method === AUTH_METHODS.NO_ACCEPTABLE) {
      throw new Socks5ProxyError('No acceptable authentication method', 'UND_ERR_SOCKS5_AUTH_REJECTED')
    }

    this.buffer = this.buffer.subarray(2)
    debug('server selected auth method', method)

    if (method === AUTH_METHODS.NO_AUTH) {
      this.markAuthenticated()
    } else if (method === AUTH_METHODS.USERNAME_PASSWORD) {
      this.state = STATES.AUTHENTICATING
      this.sendAuthRequest()
    } else {
      throw new Socks5ProxyError(`Unsupported authentication method: ${method}`, 'UND_ERR_SOCKS5_AUTH_METHOD')
    }
  }

  /**
   * Send username/password authentication request
   */
  sendAuthRequest () {
    const { username, password } = this.options

    if (!username || !password) {
      throw new InvalidArgumentError('Username and password required for authentication')
    }

    debug('sending username/password auth')

    // Username/Password authentication request (RFC 1929)
    // +----+------+----------+------+----------+
    // |VER | ULEN |  UNAME   | PLEN |  PASSWD  |

View on GitHub (pinned to 1b2de5e052)

Solutions

1. Configure the proxy to offer NO_AUTH or USERNAME_PASSWORD to this client.
2. If the method byte is unexpected, treat it as protocol corruption and reconnect on a fresh socket.
3. Confirm buffer framing is correct (no leftover bytes from a prior exchange).
4. Log the raw method byte to distinguish a real unsupported method from desync.

Example fix

// before: proxy only allows GSSAPI -> client cannot proceed

// after: reconfigure proxy to permit username/password auth
// or pick a different proxy endpoint that supports RFC 1929

try { client.handshake() } catch (e) {
  if (e.code === 'UND_ERR_SOCKS5_AUTH_METHOD') {
    // server picked an unimplemented method; reconfigure proxy or switch endpoint
  } else throw e
}

When it happens

Trigger: Server selects GSSAPI (0x01) or a challenge-response method; a malformed reply where the method byte is garbage but the version byte happened to be 0x05; server selecting a private-use method (0x80-0xFE).

Common situations: Proxy configured for GSSAPI/SSPI only; buggy proxy returning an unexpected method byte; protocol desynchronization causing the wrong byte to be read as the method.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• UND_ERR_SOCKS5_AUTH_REJECTED
• UND_ERR_SOCKS5_AUTH_VERSION
• UND_ERR_SOCKS5_VERSION
• UND_ERR_SOCKS5_AUTH_FAILED
• UND_ERR_SOCKS5_REPLY_VERSION

AI-assisted analysis of nodejs/node@1b2de5e052 (2026-08-13). Data as JSON: /api/errors/1dc7f079447546fd. Report an issue: GitHub.