CVE-2026-84961

Name of the Vulnerable Software and Affected Versions undici versions 7.24.1 through 7.29.0 undici versions 8.0.0 through 8.10.1

Description The BalancedPool constructor uses an internal deep-clone process that serializes and reparses the options object as JSON. Since JSON does not support functions, any function-valued TLS options, such as a custom checkServerIdentity callback or a custom connector within the connect option, are silently discarded. This can lead to a TLS certificate validation bypass where a peer that should be rejected by a custom checkServerIdentity function is accepted if it passes the default Node.js hostname and chain checks.

Recommendations Update undici versions 7.24.1 through 7.29.0 to version 7.29.1. Update undici versions 8.0.0 through 8.10.1 to version 8.10.2.