Description
undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| undici | undici | 4.2.1 – < 6.29.1, 7.0.0 – < 7.30.1, 8.0.0 – < 8.12.2 | 6.29.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-undici | 8.12.2+dfsg+~cs3.2.3-1 | — |
| Debian 13 | node-undici | No fix yet | — |
| Debian 12 | node-undici | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-undici | No fix yet | — |
| Ubuntu 26.04 LTS | node-undici | No fix yet | — |
| Ubuntu 24.04 LTS | node-undici | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | nodejs24 +6 | 24.21.0-1.5.hum1 | RHSA-2026:84706 |
| Red Hat Hardened Images 1 | nodejs24-npm | 11.19.0-1.24.21.0.1.5.hum1 | RHSA-2026:84706 |
| Red Hat Hardened Images 1 | nodejs26 +6 | 26.11.1-0.4.hum1 | RHSA-2026:84657 |
| Red Hat Hardened Images 1 | nodejs26-npm | 11.20.0-1.26.11.1.0.4.hum1 | RHSA-2026:84657 |
| Red Hat Hardened Images 1 | v8-13.6-devel | 13.6.233.17-1.24.21.0.1.5.hum1 | RHSA-2026:84706 |
| Red Hat Hardened Images 1 | v8-14.6-devel | 14.6.202.34-1.26.11.1.0.4.hum1 | RHSA-2026:84657 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | nodejs +4 | 1:22.23.4-1.el10_2 | ALSA-2026:96094 |
| AlmaLinux 10 | nodejs-npm | 1:10.9.9-1.22.23.4.1.el10_2 | ALSA-2026:96094 |
| AlmaLinux 10 | nodejs24 +4 | 1:24.22.1-3.el10_2 | ALSA-2026:96088 |
| AlmaLinux 10 | nodejs24-npm | 2:11.19.1-1.24.22.1.3.el10_2 | ALSA-2026:96088 |
| AlmaLinux 9 | nodejs-packaging +1 | 2021.06-6.module_el9.7.0+227+12323393 | ALSA-2026:96234 |
| AlmaLinux 8 | nodejs +4 | 1:22.23.4-2.module_el8.10.0+4358+709b81be | ALSA-2026:98113, ALSA-2026:98102 |
| AlmaLinux 8 | nodejs-nodemon | 3.1.14-2.module_el8.10.0+4250+09238ed4 | ALSA-2026:98113, ALSA-2026:98102 |
| AlmaLinux 8 | nodejs-packaging +1 | 2021.06-6.module_el8.10.0+4086+70facd4a | ALSA-2026:98113, ALSA-2026:98102 |
| AlmaLinux 8 | npm | 1:10.9.9-1.22.23.4.2.module_el8.10.0+4358+709b81be | ALSA-2026:98113, ALSA-2026:98102 |
| AlmaLinux 8 | v8-12.4-devel | 3:12.4.254.21-1.22.23.4.2.module_el8.10.0+4358+709b81be | ALSA-2026:98113 |
| AlmaLinux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.22.1.2.module_el8.10.0+4355+47fd9055 | ALSA-2026:98102 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | nodejs22 | 1:22.23.4-1.el10_2 | RLSA-2026:96094 |
| Rocky Linux 10 | nodejs24 | 1:24.22.1-3.el10_2 | RLSA-2026:96088 |
| Rocky Linux 9 | nodejs-nodemon | 3.1.14-2.module+el9.8.0+40264+d9b257bb | RLSA-2026:98522, RLSA-2026:96234 |
| Rocky Linux 9 | nodejs-packaging | 2021.06-6.module+el9.7.0+40052+e32ea525 | RLSA-2026:98522, RLSA-2026:96234, RLSA-2026:96226 |
| Rocky Linux 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+40277+b1b3f89e | RLSA-2026:98102 |
| Rocky Linux 8 | nodejs-packaging | 2021.06-6.module+el8.10.0+40048+6d99f608 | RLSA-2026:98113, RLSA-2026:98102 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | pi-coding-agent | 1.5.0-1.1 | openSUSE-SU-2026:12421-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | nodejs22 +4 | 1:22.23.4-1.amzn2023.0.1 | ALAS2023-2026-3328 |
| Amazon Linux 2023 | nodejs22-npm | 1:10.9.9-1.22.23.4.1.amzn2023.0.1 | ALAS2023-2026-3328 |
| Amazon Linux 2023 | nodejs24 +4 | 1:24.22.1-1.amzn2023.0.1 | ALAS2023-2026-3330 |
| Amazon Linux 2023 | nodejs24-npm | 1:11.19.1-1.24.22.1.1.amzn2023.0.1 | ALAS2023-2026-3330 |
| Amazon Linux 2023 | v8-12.4-devel | 3:12.4.254.21-1.22.23.4.1.amzn2023.0.1 | ALAS2023-2026-3328 |
| Amazon Linux 2023 | v8-13.6-devel | 3:13.6.233.17-1.24.22.1.1.amzn2023.0.1 | ALAS2023-2026-3330 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | nodejs +4 | 1:22.23.4-1.el10_2 | ELSA-2026-96094 |
| Oracle Linux 10 | nodejs-npm | 1:10.9.9-1.22.23.4.1.el10_2 | ELSA-2026-96094 |
| Oracle Linux 9 | nodejs +4 | 1:22.23.2-2.0.1.module+el9.8.0+91110+558b6b61 | ELSA-2026-96234, ELSA-2026-96226 |
| Oracle Linux 9 | nodejs-nodemon | 3.1.14-2.module+el9.8.0+91110+558b6b61 | ELSA-2026-96234, ELSA-2026-96226 |
| Oracle Linux 9 | nodejs-packaging +1 | 2021.06-6.module+el9.8.0+91009+5d530ccd | ELSA-2026-96234, ELSA-2026-96226 |
| Oracle Linux 9 | npm | 1:10.9.8-1.22.23.2.2.0.1.module+el9.8.0+91110+558b6b61 | ELSA-2026-96234, ELSA-2026-96226 |
| Oracle Linux 9 | v8-12.4-devel | 3:12.4.254.21-1.22.23.2.2.0.1.module+el9.8.0+91110+558b6b61 | ELSA-2026-96234 |
| Oracle Linux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.0.1.module+el9.8.0+91109+154e6434 | ELSA-2026-96226 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | node-gyp | 13.1.0-r1 | — |
| Wolfi rolling | renovate | 44.198.3-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | undici | >= 4.2.1, < 6.29.1 | 6.29.1 | GHSA-qrxm-fqhp-jwvm |
| npm | undici | >= 7.0.0, < 7.30.1 | 7.30.1 | GHSA-qrxm-fqhp-jwvm |
| npm | undici | >= 8.0.0, < 8.12.2 | 8.12.2 | GHSA-qrxm-fqhp-jwvm |
Advisories 20
- ALSA-2026:98102 Important: nodejs:24 security update AlmaLinux Security Advisories · Nov 13, 2026
- ALSA-2026:98113 Important: nodejs:22 security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 13, 2026
- RLSA-2026:98522 Important: nodejs:26 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 12, 2026
- RLSA-2026:98113 Important: nodejs:22 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 11, 2026
- RLSA-2026:98102 Important: nodejs:24 security update Rocky Linux Security Advisories · Nov 11, 2026
- ELSA-2026-96234 Important: nodejs:22 security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 11, 2026
- RLSA-2026:96088 Important: nodejs24 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 10, 2026
- RLSA-2026:96094 Important: nodejs22 security update Rocky Linux Security Advisories · Nov 10, 2026
- ALSA-2026:96088 Important: nodejs24 security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 10, 2026
- ALSA-2026:96094 Important: nodejs22 security update AlmaLinux Security Advisories · Nov 10, 2026
- ALSA-2026:96234 Important: nodejs:22 security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 10, 2026
- RLSA-2026:96226 Important: nodejs:24 security update Rocky Linux Security Advisories · Nov 10, 2026
- RLSA-2026:96234 Important: nodejs:22 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 10, 2026
- ELSA-2026-96094 Important: nodejs22 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Nov 9, 2026
- ELSA-2026-96226 Important: nodejs:24 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 9, 2026
- openSUSE-SU-2026:12421-1 pi-coding-agent-1.5.0-1.1 on GA media SUSE / openSUSE Security Updates · Nov 5, 2026
- ALAS2023-2026-3330 Important: nodejs24 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- ALAS2023-2026-3328 Important: nodejs22 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- RHSA-2026:84706 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:84657 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026