Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-84961— undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool

Quick assessment

Affected
undici undici
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

undici 的 构造函数会将完整的 对象通过一个内部深度克隆机制处理，该机制会将值序列化为 JSON 后再重新解析。由于 JSON 无法表示函数，任何取值为函数的 TLS 选项（例如调用方提供的 回调，或 选项中的自定义连接器）会在到达 TLS 层之前被静默丢弃。因此，对于应用程序的自定义 本应拒绝其证书的 peer，只要它仍能通过 Node 默认的 hostname 和证书链检查，当通过 连接时就会被视为有效并被接受。而 、 和 派发器不受此问题影响，因为它们在克隆之前会提取 和 选项。该漏洞影响 undici

CVSS 7.4 · High

Possible ATT&CK Techniques 1 AI

T1557 · Adversary-in-the-Middle

Affected Version Matrix 4

VendorProduct Version RangeStatus
undici undici 7.24.1< 7.29.1 affected
7.29.1 unaffected
8.0.0< 8.10.2 affected
8.10.2 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-84961

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool
Source: CVE Program / CVE List V5
Vulnerability Description
undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer whose certificate the application's custom checkServerIdentity was written to reject, but which still passes Node's default hostname and chain checks, is accepted when reached through BalancedPool. The Client, Pool, and Agent dispatchers are not affected because they extract the connect and tls options before cloning. This affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2, and only when the application supplies a function-valued connect or tls option to BalancedPool. Users should upgrade to undici 7.29.1 or 8.10.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
undici undici 7.24.1 ~ 7.29.1 -

II. Public POCs for CVE-2026-84961

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-84961

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-84961 (1)

Same Patch Batch · undici · 2026-09-04 · 11 CVEs total

CVE-2026-19534 7.5 HIGH undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
CVE-2026-85152 7.4 HIGH undici vulnerable to cross-origin cache poisoning via missing origin isolation in intercep
CVE-2026-84933 6.5 MEDIUM undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches
CVE-2026-85024 5.9 MEDIUM undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate
CVE-2026-85014 5.9 MEDIUM undici vulnerable to Denial of Service via WebSocketStream unclean close
CVE-2026-18149 5.9 MEDIUM undici vulnerable to Denial of Service via orphaned RetryHandler response body
CVE-2026-84890 5.9 MEDIUM undici vulnerable to Denial of Service via unbounded decompression of compressed responses
CVE-2026-85008 3.7 LOW undici vulnerable to caching and replay of unsafe HTTP method responses
CVE-2026-84947 3.7 LOW undici vulnerable to response truncation via oversized chunked responses in the dump inter
CVE-2026-18540 3.7 LOW undici vulnerable to downstream response splitting via retry interceptor

IV. Related Vulnerabilities

Same product: undici
Same vendor: undici
Same weakness: CWE-295

V. Comments for CVE-2026-84961

No comments yet

Leave a comment