CVE-2026-87018

Name of the Vulnerable Software and Affected Versions undici versions 4.2.1 through 6.29.0 undici versions 7.0.0 through 7.30.0 undici versions 8.0.0 through 8.12.1

Description An issue exists in the HTTP client library where the client process crashes during a TLS 1.2 server renegotiation. This occurs when a server presents a CA-trusted certificate with a hostname that does not match the requested host after the connection is established. Node.js performs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error. Because the established-socket error handler incorrectly asserts that this error code cannot occur, it results in an uncaught assertion that terminates the Node.js process, impacting both HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint can trigger this crash via a single server-initiated renegotiation, affecting the global fetch() function and all in-flight requests. This only affects TLS 1.2 as TLS 1.3 does not support renegotiation.

Recommendations Update versions 4.2.1 through 6.29.0 to 6.29.1 or later. Update versions 7.0.0 through 7.30.0 to 7.30.1 or later. Update versions 8.0.0 through 8.12.1 to 8.12.2 or later. Restrict outbound connections to TLS 1.3 to prevent renegotiation when supported by target endpoints.