Node "tunneling socket could not be established" (HTTPS_PROXY) in CI

By Kaveh Alemi·Latchkey

A Node client tried to open an HTTPS tunnel through the proxy named in HTTPS_PROXY and the CONNECT failed. The status code in the message tells you why: a refused connection means the proxy is unreachable, a 407 means it needs auth.

What this error means

npm install or a Node HTTPS request fails with "tunneling socket could not be established, cause=..." and a nested error such as ECONNREFUSED or "statusCode=407".

Error: tunneling socket could not be established,
cause=connect ECONNREFUSED 10.0.0.5:8080

Common causes

The proxy host or port is wrong or unreachable

An ECONNREFUSED or timeout cause means HTTPS_PROXY points at a proxy that is down, on the wrong port, or blocked from the runner.

The proxy rejected the tunnel

A 407 or 403 in the cause means the proxy is reachable but refused to open the tunnel, usually an authentication or policy issue.

How to fix it

Verify and correct the proxy URL

1. Print HTTPS_PROXY and confirm the host and port match a live proxy.
2. Test reachability to that host:port from the runner.
3. Fix the value (or add credentials for a 407) and re-run.

node -e "console.log(process.env.HTTPS_PROXY)"
curl -x "$HTTPS_PROXY" https://registry.npmjs.org/ -I

Align npm proxy config with the env

npm has its own proxy settings; keep them consistent with the environment so both use the same reachable proxy.

npm config set proxy http://proxy.corp.example:8080
npm config set https-proxy http://proxy.corp.example:8080

How to prevent it

• Set proxy env vars centrally so every Node tool uses the same value.
• Validate the proxy host:port is reachable before jobs depend on it.
• Keep npm proxy config and HTTPS_PROXY in agreement to avoid split behavior.

Frequently asked questions

Related guides

References

• GitHub Actions documentation