undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool
Impact
undici's BalancedPool passes its constructor options through a JSON-based deep clone (JSON.parse(JSON.stringify(...))) before forwarding them to each per-upstream Pool. JSON cannot represent functions, so a caller-supplied connect or tls option containing a checkServerIdentity callback (or a custom connector function) is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reject, but which passes Node's default hostname and chain checks, is silently accepted when the request is made through BalancedPool. Client, Pool, Agent, and RoundRobinPool destructure connect/tls before the clone and are not affected. Only applications that use BalancedPool with a function-valued connect/tls option (such as a custom checkServerIdentity or connector) are affected.
Patches
Upgrade to 7.29.1 or 8.10.2. BalancedPool now preserves the connect and tls options outside the JSON clone, so custom TLS verification callbacks are forwarded to each upstream unchanged.
Workarounds
Use Client, Pool, or Agent instead of BalancedPool for connections that rely on a custom checkServerIdentity or connector, until upgraded.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | undici | >= 7.24.1, < 7.29.1, >= 8.0.0, < 8.10.2 | 7.29.1, 8.10.2 |
References
- https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3
- https://nvd.nist.gov/vuln/detail/CVE-2026-84961
- https://github.com/nodejs/undici/commit/8f5868fbdbc8f1146dfc1bcd1f2d117790141390
- https://github.com/nodejs/undici/commit/f690157d728508652fef14673630c71515123e96
- https://cna.openjsf.org/security-advisories.html
- https://github.com/nodejs/undici
- https://github.com/nodejs/undici/releases/tag/v7.29.1
- https://github.com/nodejs/undici/releases/tag/v8.10.2
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N- Weakness (CWE)
CWE-295- Platform
- npm
- Package
undici- Disclosed
- 29.09.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-w293-vg96-wgc3 - CC BY 4.0
Vulnerability history: undici
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 46
- First → latest
- 06.2022 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 13
- Medium 21
- Low 12
Disclosures per year
- 2022: 5
- 2023: 3
- 2024: 5
- 2025: 2
- 2026: 31
-
undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.