Socket hijacking is the abuse of connection setup so a request uses an unintended socket path, such as a different Unix domain socket, local service endpoint, or other low-level transport target. Instead of sending traffic where the application expects, the request is steered through a path chosen by the attacker or by corrupted configuration.
This matters because the socket determines where the bytes actually go. If an attacker can influence fields like socketPath, proxy settings, adapter behavior, or merged request options, they may bypass network policy, reach internal services, or redirect requests away from expected controls. In practice, this can support SSRF-style abuse, local service exposure, or request manipulation. Defenses include strict validation of outbound request options, rejecting untrusted connection settings, avoiding unsafe object merges, and limiting which sockets or agents an application may use.