PT-2026-85804
CVE-2026-84961
·
تاريخ النشر
2026-09-04
·
تاريخ التحديث
2026-10-10
الوصف من
CVSS 3.1
9.1
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions
undici versions 7.24.1 through 7.29.0
undici versions 8.0.0 through 8.10.1
Description
The
BalancedPool constructor uses an internal deep-clone process that serializes and reparses the options object as JSON. Since JSON does not support functions, any function-valued TLS options, such as a custom checkServerIdentity callback or a custom connector within the connect option, are silently discarded. This can lead to a TLS certificate validation bypass where a peer that should be rejected by a custom checkServerIdentity function is accepted if it passes the default Node.js hostname and chain checks.Recommendations
Update undici versions 7.24.1 through 7.29.0 to version 7.29.1.
Update undici versions 8.0.0 through 8.10.1 to version 8.10.2.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾