Vulnerabilities

The BalancedPool constructor in the undici HTTP client library deep-clones its options object by serializing and reparsing it as JSON, which silently discards any function-valued TLS options such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option. An application that relies on such a callback to enforce custom certificate checks will accept a server certificate that the callback was written to reject, provided the certificate still passes Node.js's default hostname and chain checks, enabling server impersonation or man-in-the-middle attacks with confidentiality and integrity impact. Only applications running undici 7.24.1 through 7.29.0 or 8.0.0 through 8.10.1 that pass function-valued connect or tls options to BalancedPool are affected; the Client, Pool, and Agent dispatchers are unaffected because they extract those options before cloning. There is no public proof-of-concept, no report of exploitation in the wild, the CVE is not in CISA's KEV, and EPSS assigns a 0.1% probability of exploitation within 30 days.

Do: Upgrade undici to 7.29.1 (for the 7.x line) or 8.10.2 (for the 8.x line). As interim mitigations, replace BalancedPool with the unaffected Pool or Agent dispatchers, or avoid passing function-valued connect/tls options (e.g. checkServerIdentity or custom connectors) to BalancedPool. Audit application code and dependencies for BalancedPool usage combined with custom TLS validation callbacks to determine whether custom certificate checks are currently being bypassed.

undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer's error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.

A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.