CVE-2026-84961

The BalancedPool constructor in the undici HTTP client library deep-clones its options object by serializing and reparsing it as JSON, which silently discards any function-valued TLS options such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option. An application that relies on such a callback to enforce custom certificate checks will accept a server certificate that the callback was written to reject, provided the certificate still passes Node.js's default hostname and chain checks, enabling server impersonation or man-in-the-middle attacks with confidentiality and integrity impact. Only applications running undici 7.24.1 through 7.29.0 or 8.0.0 through 8.10.1 that pass function-valued connect or tls options to BalancedPool are affected; the Client, Pool, and Agent dispatchers are unaffected because they extract those options before cloning. There is no public proof-of-concept, no report of exploitation in the wild, the CVE is not in CISA's KEV, and EPSS assigns a 0.1% probability of exploitation within 30 days.

What to do: Upgrade undici to 7.29.1 (for the 7.x line) or 8.10.2 (for the 8.x line). As interim mitigations, replace BalancedPool with the unaffected Pool or Agent dispatchers, or avoid passing function-valued connect/tls options (e.g. checkServerIdentity or custom connectors) to BalancedPool. Audit application code and dependencies for BalancedPool usage combined with custom TLS validation callbacks to determine whether custom certificate checks are currently being bypassed.