CVE-2026-84961: undici TLS Certificate Validation Bypass in BalancedPool
Summary
CVE-2026-84961: undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool. Affects undici across 2 version ranges.
>= 7.24.1, < 7.29.1
>= 8.0.0, < 8.10.2
Fixed in 7.29.1 or 8.10.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
undici is a high-performance HTTP/1.1 client designed for Node.js, providing a simple API for making HTTP requests. It is known for its efficiency and speed, making it a popular choice among developers. However, a vulnerability has been identified in its BalancedPool component, which can lead to serious security risks when custom TLS verification is required.
Vulnerability Detail
The vulnerability arises from the way undici's BalancedPool handles its constructor options. It uses a JSON-based deep clone method that cannot represent functions, leading to the silent dropping of user-defined connect or tls options, including custom checkServerIdentity callbacks. This means that if a custom callback is intended to reject a TLS peer's certificate, it may be bypassed, allowing potentially malicious certificates to be accepted if they pass Node's default checks. This flaw primarily affects applications utilizing BalancedPool with function-valued connect or tls options.
How To Fix
Latest published version: 8.12.3 as of 22 Oct 2026
npm install undici@8.12.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 7.24.1, < 7.29.17.29.1npm install undici@7.29.1 -
>= 8.0.0, < 8.10.28.10.2npm install undici@8.10.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider using the Client, Pool, or Agent components instead of BalancedPool for connections that require a custom checkServerIdentity or connector function. This will prevent the vulnerability from being exploited until you can upgrade.
Conclusion
The undici package has a significant vulnerability that can lead to TLS certificate validation bypass when using BalancedPool. It is crucial to upgrade to the patched versions to mitigate this risk. Additionally, using alternative components can serve as a temporary solution until the upgrade is performed.
See every vulnerability recorded for undici →
FAQ
The vulnerability allows for a TLS certificate validation bypass due to the dropping of custom connect or tls options in BalancedPool.
If your application uses BalancedPool with a custom checkServerIdentity or connector function, it may be affected by this vulnerability.
The primary risk is the acceptance of potentially malicious TLS certificates, which could lead to man-in-the-middle attacks or data breaches.
You can upgrade undici by running 'npm install undici@7.29.1' or 'npm install undici@8.10.2' in your project directory.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your package-lock.json file. You can also check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for undici.
