nodejs/node · error · Socks5ProxyError

UND_ERR_SOCKS5_AUTH_REJECTED

UND_ERR_SOCKS5_AUTH_REJECTED

Error message

No acceptable authentication method

What it means

Thrown in handleHandshakeResponse when the server's selected method is AUTH_METHODS.NO_ACCEPTABLE (0xFF). Per RFC 1928, 0xFF means the server found no acceptable method among the ones the client offered. This is a configuration/capability mismatch, not malformed data.

Source

Thrown at deps/undici/src/lib/core/socks5-client.js:195

  }

  /**
   * Handle handshake response from server
   */
  handleHandshakeResponse () {
    if (this.buffer.length < 2) {
      return // Not enough data yet
    }

    const version = this.buffer[0]
    const method = this.buffer[1]

    if (version !== SOCKS_VERSION) {
      throw new Socks5ProxyError(`Invalid SOCKS version: ${version}`, 'UND_ERR_SOCKS5_VERSION')
    }

    if (method === AUTH_METHODS.NO_ACCEPTABLE) {
      throw new Socks5ProxyError('No acceptable authentication method', 'UND_ERR_SOCKS5_AUTH_REJECTED')
    }

    this.buffer = this.buffer.subarray(2)
    debug('server selected auth method', method)

    if (method === AUTH_METHODS.NO_AUTH) {
      this.markAuthenticated()
    } else if (method === AUTH_METHODS.USERNAME_PASSWORD) {
      this.state = STATES.AUTHENTICATING
      this.sendAuthRequest()
    } else {
      throw new Socks5ProxyError(`Unsupported authentication method: ${method}`, 'UND_ERR_SOCKS5_AUTH_METHOD')
    }
  }

  /**
   * Send username/password authentication request
   */

View on GitHub (pinned to 1b2de5e052)

Solutions

1. Provide username/password in the proxy options or the socks5://user:pass@host URL.
2. Add AUTH_METHODS.USERNAME_PASSWORD to the client's offered methods.
3. Confirm the proxy's required authentication methods with the operator.
4. If the proxy truly supports NO_AUTH, check that you connected to the right listener.

Example fix

// before
const opts = { authMethods: [AUTH_METHODS.NO_AUTH] }

// after
const opts = {
  username: process.env.PROXY_USER,
  password: process.env.PROXY_PASS,
  authMethods: [AUTH_METHODS.USERNAME_PASSWORD]
}

const wantsAuth = (opts.authMethods || []).includes(AUTH_METHODS.USERNAME_PASSWORD)
const hasCreds = opts.username && opts.password
if (!wantsAuth && !hasCreds && !opts.allowAnonymous) {
  throw new Error('configure auth or confirm proxy allows NO_AUTH')
}

try { client.handshake() } catch (e) {
  if (e.code === 'UND_ERR_SOCKS5_AUTH_REJECTED') { /* add credentials and retry on new client */ }
  else throw e
}

When it happens

Trigger: Client offered only NO_AUTH but the server requires USERNAME_PASSWORD; client offered USERNAME_PASSWORD but server only accepts GSSAPI or a method not implemented; server policy mandates authentication that the client did not configure.

Common situations: Proxy requires auth but credentials were not supplied; using socks5:// URL where socks5h:// with credentials was needed; proxy hardened to require authentication while the client runs anonymous.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• UND_ERR_SOCKS5_VERSION
• UND_ERR_SOCKS5_AUTH_METHOD
• UND_ERR_SOCKS5_AUTH_VERSION
• UND_ERR_SOCKS5_AUTH_FAILED
• UND_ERR_SOCKS5_REPLY_VERSION

AI-assisted analysis of nodejs/node@1b2de5e052 (2026-08-13). Data as JSON: /api/errors/490bbbd487c45e9a. Report an issue: GitHub.