Description
undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer whose certificate the application's custom checkServerIdentity was written to reject, but which still passes Node's default hostname and chain checks, is accepted when reached through BalancedPool. The Client, Pool, and Agent dispatchers are not affected because they extract the connect and tls options before cloning. This affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2, and only when the application supplies a function-valued connect or tls option to BalancedPool. Users should upgrade to undici 7.29.1 or 8.10.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| undici | undici | 7.24.1 – < 7.29.1, 8.0.0 – < 8.10.2 | 7.29.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-undici | 8.10.2+dfsg+~cs3.2.2-1 | — |
| Debian 13 | node-undici | No fix yet | — |
| Debian 12 | node-undici | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-undici | No fix yet | — |
| Ubuntu 26.04 LTS | node-undici | No fix yet | — |
| Ubuntu 24.04 LTS | node-undici | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | nodejs24 +4 | 1:24.21.0-1.el10_2 | RHSA-2026:73428 |
| RHEL 10 | nodejs24-npm | 2:11.19.0-1.24.21.0.1.el10_2 | RHSA-2026:73428 |
| RHEL 10 | nodejs26 +4 | 1:26.8.2-1.el10_3 | RHSA-2026:98060 |
| RHEL 10 | nodejs26-npm | 1:11.19.1-1.26.8.2.1.el10_3 | RHSA-2026:98060 |
| RHEL 9 | nodejs +4 | 1:24.21.0-1.module+el9.8.0+24924+cd677006 | RHSA-2026:97855, RHSA-2026:73838 |
| RHEL 9 | nodejs-nodemon | 3.1.14-1.module+el9.9.0+24923+ac50c00f | RHSA-2026:97855, RHSA-2026:73838 |
| RHEL 9 | nodejs-packaging +1 | 2021.06-6.module+el9.8.0+24708+e71d2e1d | RHSA-2026:97855, RHSA-2026:73838 |
| RHEL 9 | npm | 1:11.19.0-1.24.21.0.1.module+el9.8.0+24924+cd677006 | RHSA-2026:97855, RHSA-2026:73838 |
| RHEL 9 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.module+el9.8.0+24924+cd677006 | RHSA-2026:73838 |
| RHEL 9 | v8-14.6-devel | 3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5 | RHSA-2026:97855 |
| RHEL 8 | nodejs +4 | 1:24.21.0-1.module+el8.10.0+24927+ed3d907a | RHSA-2026:74085 |
| RHEL 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+24711+b610b202 | RHSA-2026:74085 |
| RHEL 8 | nodejs-packaging +1 | 2021.06-6.module+el8.10.0+24711+b610b202 | RHSA-2026:74085 |
| RHEL 8 | npm | 1:11.19.0-1.24.21.0.1.module+el8.10.0+24927+ed3d907a | RHSA-2026:74085 |
| RHEL 8 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.module+el8.10.0+24927+ed3d907a | RHSA-2026:74085 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.10-0.2.hum1 | RHSA-2026:66008 |
| Red Hat Hardened Images 1 | nodejs24 +6 | 1:24.18.1-0.2.2.hum1 | RHSA-2026:54438 |
| Red Hat Hardened Images 1 | nodejs24-npm | 1:11.16.0-1.24.18.1.0.2.2.hum1 | RHSA-2026:54438 |
| Red Hat Hardened Images 1 | nodejs26 +6 | 1:26.8.2-0.1.hum1 | RHSA-2026:66605 |
| Red Hat Hardened Images 1 | nodejs26-npm | 1:11.19.1-1.26.8.2.0.1.hum1 | RHSA-2026:66605 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | nodejs24 +4 | 1:24.21.0-1.el10_2 | ALSA-2026:73428 |
| AlmaLinux 10 | nodejs24-npm | 2:11.19.0-1.24.21.0.1.el10_2 | ALSA-2026:73428 |
| AlmaLinux 9 | nodejs +4 | 1:24.21.0-1.module_el9.8.0+321+1555b6a2 | ALSA-2026:73838 |
| AlmaLinux 9 | nodejs-nodemon | 3.1.14-3.module_el9.8.0+292+f4eaf8b2 | ALSA-2026:73838 |
| AlmaLinux 9 | nodejs-packaging +1 | 2021.06-6.module_el9.7.0+209+ecf6523e | ALSA-2026:73838 |
| AlmaLinux 9 | npm | 1:11.19.0-1.24.21.0.1.module_el9.8.0+321+1555b6a2 | ALSA-2026:73838 |
| AlmaLinux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.module_el9.8.0+321+1555b6a2 | ALSA-2026:73838 |
| AlmaLinux 8 | nodejs +4 | 1:24.21.0-1.module_el8.10.0+4292+21afb960 | ALSA-2026:74085 |
| AlmaLinux 8 | nodejs-nodemon | 3.1.14-2.module_el8.10.0+4250+09238ed4 | ALSA-2026:74085 |
| AlmaLinux 8 | nodejs-packaging +1 | 2021.06-6.module_el8.10.0+4086+70facd4a | ALSA-2026:74085 |
| AlmaLinux 8 | npm | 1:11.19.0-1.24.21.0.1.module_el8.10.0+4292+21afb960 | ALSA-2026:74085 |
| AlmaLinux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.module_el8.10.0+4292+21afb960 | ALSA-2026:74085 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | nodejs24 | 1:24.21.0-1.el10_2 | RLSA-2026:73428 |
| Rocky Linux 10 | nodejs26 +4 | 1:26.8.2-1.el10_3 | RLSA-2026:98060 |
| Rocky Linux 10 | nodejs26-npm | 1:11.19.1-1.26.8.2.1.el10_3 | RLSA-2026:98060 |
| Rocky Linux 9 | nodejs-nodemon | 3.1.14-1.module+el9.8.0+40263+faa47049 | RLSA-2026:97855, RLSA-2026:73838 |
| Rocky Linux 9 | nodejs-packaging | 2021.06-6.module+el9.7.0+40052+e32ea525 | RLSA-2026:97855, RLSA-2026:73838 |
| Rocky Linux 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+40277+b1b3f89e | RLSA-2026:74085 |
| Rocky Linux 8 | nodejs-packaging | 2021.06-6.module+el8.10.0+40048+6d99f608 | RLSA-2026:74085 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | pi-coding-agent | 0.87.1-1.1 | openSUSE-SU-2026:11884-1 |
| openSUSE Leap 16.0 | pi-coding-agent | 1.0.4-bp160.1.1 | openSUSE-SU-2026:22111-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | nodejs24 +4 | 1:24.21.0-1.amzn2023.0.1 | ALAS2023-2026-3107 |
| Amazon Linux 2023 | nodejs24-npm | 1:11.19.0-1.24.21.0.1.amzn2023.0.1 | ALAS2023-2026-3107 |
| Amazon Linux 2023 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.amzn2023.0.1 | ALAS2023-2026-3107 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | nodejs24 +4 | 1:24.21.0-1.0.1.el10_2 | ELSA-2026-73428 |
| Oracle Linux 10 | nodejs24-npm | 2:11.19.0-1.24.21.0.1.0.1.el10_2 | ELSA-2026-73428 |
| Oracle Linux 9 | nodejs +4 | 1:24.21.0-1.module+el9.8.0+91053+65d3e6aa | ELSA-2026-73838 |
| Oracle Linux 9 | nodejs-nodemon | 3.1.14-3.module+el9.8.0+91009+5d530ccd | ELSA-2026-73838 |
| Oracle Linux 9 | nodejs-packaging +1 | 2021.06-6.module+el9.8.0+91009+5d530ccd | ELSA-2026-73838 |
| Oracle Linux 9 | npm | 1:11.19.0-1.24.21.0.1.module+el9.8.0+91053+65d3e6aa | ELSA-2026-73838 |
| Oracle Linux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.module+el9.8.0+91053+65d3e6aa | ELSA-2026-73838 |
| Oracle Linux 8 | nodejs +4 | 1:24.21.0-1.module+el8.10.0+91054+4b1a799c | ELSA-2026-74085 |
| Oracle Linux 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+91054+4b1a799c | ELSA-2026-74085 |
| Oracle Linux 8 | nodejs-packaging +1 | 2021.06-6.module+el8.10.0+91054+4b1a799c | ELSA-2026-74085 |
| Oracle Linux 8 | npm | 1:11.19.0-1.24.21.0.1.module+el8.10.0+91054+4b1a799c | ELSA-2026-74085 |
| Oracle Linux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.module+el8.10.0+91054+4b1a799c | ELSA-2026-74085 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | code-server | 4.139.1-r2 | — |
| Wolfi rolling | lerna | 10.0.1-r11 | — |
| Wolfi rolling | node-gyp | 13.0.2-r1 | — |
| Wolfi rolling | prism | 5.16.0-r14 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | undici | >= 7.24.1, < 7.29.1 | 7.29.1 | GHSA-w293-vg96-wgc3 |
| npm | undici | >= 8.0.0, < 8.10.2 | 8.10.2 | GHSA-w293-vg96-wgc3 |
Advisories 24
- RHSA-2026:97855 Red Hat Security Advisory: nodejs:26 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:98060 Red Hat Security Advisory: nodejs26 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:66605 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:54438 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:66008 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RLSA-2026:98060 Important: nodejs26 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 13, 2026
- WID-SEC-2026-3640 Red Hat Enterprise Linux (undici-nodejs): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- RLSA-2026:97855 Important: nodejs:26 security update Rocky Linux Security Advisories · Nov 11, 2026
- WID-SEC-2026-3596 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- ALSA-2026:73838 Important: nodejs:24 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:73428 Important: nodejs24 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:74085 Important: nodejs:24 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:74085 Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:73838 Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:73428 Red Hat Security Advisory: nodejs24 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- openSUSE-SU-2026:22111-1 Security update for pi-coding-agent SUSE / openSUSE Security Updates · Oct 19, 2026
- ELSA-2026-74085 Important: nodejs:24 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 2, 2026
- RLSA-2026:73428 Important: nodejs24 security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 1, 2026
- RLSA-2026:74085 Important: nodejs:24 security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 1, 2026
- RLSA-2026:73838 Important: nodejs:24 security, bug fix, and enhancement update Rocky Linux Security Advisories · Sep 30, 2026
- ELSA-2026-73428 Important: nodejs24 security, bug fix, and enhancement update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Sep 30, 2026
- ELSA-2026-73838 Important: nodejs:24 security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Sep 30, 2026
- ALAS2023-2026-3107 Important: nodejs24 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 28, 2026
- openSUSE-SU-2026:11884-1 pi-coding-agent-0.87.1-1.1 on GA media SUSE / openSUSE Security Updates · Sep 25, 2026