CVE-2026-109383

Name of the Vulnerable Software and Affected Versions undici versions 4.0.0 through 6.29.0 undici versions 7.0.0 through 7.30.0 undici versions 8.0.0 through 8.12.1

Description The Agent dispatcher performs a JSON-based deep clone of constructor options before forwarding them to per-origin pools. Since JSON cannot represent functions, any tls option containing a checkServerIdentity callback is silently dropped. This allows a TLS peer to be accepted if it passes default hostname and chain checks, even if a custom checkServerIdentity was intended to reject it. This issue affects the default paths used by request, fetch, and setGlobalDispatcher, as well as the direct and no-proxy routes of EnvHttpProxyAgent. Only applications using function-valued tls options for tasks like certificate or public-key pinning are at risk.

Recommendations Update versions 4.0.0 through 6.29.0 to 6.29.1 or later. Update versions 7.0.0 through 7.30.0 to 7.30.1 or later. Update versions 8.0.0 through 8.12.1 to 8.12.2 or later. As a workaround, pass TLS options through connect instead of tls, or use requestTls and proxyTls for proxied destinations.