IT SBIT Services
Schneeberger
DEEN
CVE tracker

undici: Improper certificate validation in Agent dispatcher

CVE-2026-109383Critical 9.1

← All vulnerabilities

Summary

undici, the HTTP client library for Node.js, silently drops function-valued tls options such as a custom checkServerIdentity when they are passed to Agent, the default dispatcher behind request, fetch and setGlobalDispatcher. A TLS peer whose certificate the custom callback should reject, but which passes Node's default hostname and chain checks, is then accepted. Only applications that rely on such callbacks for certificate or public-key pinning are at risk, and an on-path attacker is required. The scores differ between sources (9.1 in the CVE data, 7.4 in the GitHub advisory).

Affected

  • undici 4.0.0 to before 6.29.1
  • undici 7.0.0 to before 7.30.1
  • undici 8.0.0 to before 8.12.2
  • Unknown: which Node.js releases bundle an affected undici version.

Fixed in

  • undici 6.29.1
  • undici 7.30.1
  • undici 8.12.2
  • Upgrade to one of these or a later version.

Workaround

  • Pass TLS options through connect instead of tls.
  • For proxied destinations, use requestTls and proxyTls.
  • These workarounds apply only to applications that pin certificates; they are not a general fix.

Exploitation

  • No exploitation known at the time of research.
  • No public exploit found. CISA SSVC: Exploitation none, Automatable no, Technical Impact total.

Our recommendation

  • Update undici to 6.29.1, 7.30.1, 8.12.2 or later through routine dependency updates, including transitive dependencies in build tools and CI pipelines.
  • Prioritise applications that use a custom checkServerIdentity or certificate or public-key pinning, such as integrations with banks or payment providers.
  • Check lockfiles and dependency trees for affected undici versions.
  • Until patched, use the connect-based workaround in pinning code.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:31.

Original description (NVD)

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent functions, a caller-supplied tls option containing a checkServerIdentity callback is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reject, but which passes Node's default hostname and chain checks, is silently accepted. Because Agent is the default dispatcher behind request, fetch, and setGlobalDispatcher, this affects the path most applications use, and EnvHttpProxyAgent is affected on its direct and no-proxy routes as well, while only applications that pass a function-valued tls option such as a custom checkServerIdentity for certificate or public-key pinning are at risk. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which preserve the tls option outside the JSON clone so custom verification callbacks are forwarded unchanged, and users should upgrade to one of those versions or later. As a workaround, pass the TLS options through connect instead of tls, or for proxied destinations use requestTls and proxyTls.

NVD references (2)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed