VulnSocial

CVE-2026-84961Patch(nodejs / undici)

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch nodejs undici systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer whose certificate the application's custom checkServerIdentity was written to reject, but which still passes Node's default hostname and chain checks, is accepted when reached through BalancedPool. The Client, Pool, and Agent dispatchers are not affected because they extract the connect and tls options before cloning. This affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2, and only when the application supplies a function-valued connect or tls option to BalancedPool. Users should upgrade to undici 7.29.1 or 8.10.2.

nodejs CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-295

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • undici

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • Peaked 1d ago at 1 mentions (2026-09-04); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
nodejs
Products
undici

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-04: 1Mentions · 2026-09-30: 1Patch / Workaround · 2026-09-04: 1Patch / Workaround · 2026-09-30: 1Technical Details · 2026-09-04: 1Technical Details · 2026-09-30: 109-0409-30
Signal classification1 categories
Patch
2100.0%
Referenced assets1 URL
By indicator
Full discourse2 posts
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨Critical - undici BalancedPool TLS Validation Bypass via Option JSON-Clone (CVE-2026-84961) undici BalancedPool JSON-clones constructor options, dropping function-valued TLS/connect fields like checkServerIdentity or a custom connector. An attacker with a cert that passes Node default checks but fails app custom validation can get accepted when BalancedPool is used, bypassing intended TLS verification. Client, Pool, Agent, and RoundRobinPool are not affected. 👉Affected: undici BalancedPool < 7.29.1 (7.x) and < 8.10.2 (8.x) | Upgrade to 7.29.1 or 8.10.2

    Post summary

    The tweet announces a critical TLS validation bypass in undici's BalancedPool (CVE-2026-84961) and advises upgrading to version 7.29.1 (7.x) or 8.10.2 (8.x); no PoC, exploit code, or active exploitation is reported.

    0001064
    311 followersView on X
  • Ulises Gascón@kom_256
    Patch

    🚨 High-severity security fix in undici (7.29.1, 8.10.2) just released! Patches CVE-2026-84961: undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3

    Post summary

    The text announces a high‑severity security fix for CVE‑2026‑84961 in undici, describing a TLS certificate validation bypass vulnerability and providing patch versions and an advisory link.

    00000168
    5.6K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appnodejsundici-node.js-

Explore more

Back to dashboardnodejs CVEsundici vulnerabilities