[ CVE-2026-84961 · Published 4 Sep 2026 ]
undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool
[ Description ]Official description
undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer whose certificate the application's custom checkServerIdentity was written to reject, but which still passes Node's default hostname and chain checks, is accepted when reached through BalancedPool. The Client, Pool, and Agent dispatchers are not affected because they extract the connect and tls options before cloning. This affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2, and only when the application supplies a function-valued connect or tls option to BalancedPool. Users should upgrade to undici 7.29.1 or 8.10.2.
[ Fixes ]Fixes and patches
- undici 7.29.1Fixed version · GitHub Advisories · npm package undici: upgrade to 7.29.1 or later (affected >= 7.24.1, < 7.29.1)
- undici 8.10.2Fixed version · GitHub Advisories · npm package undici: upgrade to 8.10.2 or later (affected >= 8.0.0, < 8.10.2)
[ Advisories ]Government CERT advisories
-
CERT-FRCERTFR-2026-AVI-1336
Multiple vulnerabilities in IBM products Translated from French
Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.
-
BSI CERT-BundWID-SEC-2026-3640
Red Hat Enterprise Linux (undici-nodejs): Multiple vulnerabilities Translated from German
-
BSI CERT-BundWID-SEC-2026-3596
IBM App Connect Enterprise: Multiple vulnerabilities Translated from German
-
CERT-FRCERTFR-2026-AVI-1233
Multiple vulnerabilities in IBM products Translated from French
Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, remote denial of service and a breach of data confidentiality.
[ Packages ]Affected open-source packages
- undici npmAffected >= 7.24.1, < 7.29.1 · fixed in 7.29.1 · GHSA-w293-vg96-wgc3
- undici npmAffected >= 8.0.0, < 8.10.2 · fixed in 8.10.2 · GHSA-w293-vg96-wgc3