Vulnerabilities

The BalancedPool constructor in the undici HTTP client library deep-clones its options object by serializing and reparsing it as JSON, which silently discards any function-valued TLS options such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option. An application that relies on such a callback to enforce custom certificate checks will accept a server certificate that the callback was written to reject, provided the certificate still passes Node.js's default hostname and chain checks, enabling server impersonation or man-in-the-middle attacks with confidentiality and integrity impact. Only applications running undici 7.24.1 through 7.29.0 or 8.0.0 through 8.10.1 that pass function-valued connect or tls options to BalancedPool are affected; the Client, Pool, and Agent dispatchers are unaffected because they extract those options before cloning. There is no public proof-of-concept, no report of exploitation in the wild, the CVE is not in CISA's KEV, and EPSS assigns a 0.1% probability of exploitation within 30 days.

Do: Upgrade undici to 7.29.1 (for the 7.x line) or 8.10.2 (for the 8.x line). As interim mitigations, replace BalancedPool with the unaffected Pool or Agent dispatchers, or avoid passing function-valued connect/tls options (e.g. checkServerIdentity or custom connectors) to BalancedPool. Audit application code and dependencies for BalancedPool usage combined with custom TLS validation callbacks to determine whether custom certificate checks are currently being bypassed.

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.

undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer's error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.

A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination. This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP. Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin. This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0. Patches: Upgrade to undici v7.26.0 or v8.2.0. Workarounds: Use a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.

CVE-2026-21710 is a denial-of-service flaw (CWE-843 type confusion, also tagged CWE-770) in the HTTP request handling of Node.js release lines 20.x, 22.x, 24.x, and 25.x, triggered when a client sends a request with a header literally named `__proto__` and the application reads `req.headersDistinct`. Because the header collides with JavaScript's prototype mechanism, `dest["__proto__"]` resolves to Object.prototype instead of undefined, causing the code to call `.push()` on a non-array and throw a synchronous TypeError. The exception is thrown inside a property getter and is not routed through the request's `error` event, so an attacker's single crafted request crashes request handling and yields availability impact (CVSS 7.5, availability-only) unless every `req.headersDistinct` access is wrapped in try/catch. All applications running HTTP servers on affected Node.js versions are exposed, including Node.js as shipped in Red Hat Enterprise Linux and RHEL Extended Update Support (EUS), although only code paths that actually read `req.headersDistinct` can be crashed by this trigger. No public proof-of-concept or confirmed exploitation exists yet, but the EPSS score of 25% within 30 days (98th percentile) indicates elevated near-term exploitation risk.

Do: Upgrade Node.js to the latest patched release published for your current release line (20.x, 22.x, 24.x, or 25.x) once fixes ship, and apply the corresponding updated nodejs packages from Red Hat advisories for RHEL and RHEL EUS systems. As interim mitigation, wrap every `req.headersDistinct` access in try/catch or reject/strip requests containing a `__proto__` header at a reverse proxy. Prioritize remediation given the high EPSS (25% probability of exploitation within 30 days).

Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire. Who is impacted: * Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays * Applications that accept user-controlled header names without case-normalization Potential consequences: * Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request) * HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking

A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution. * The issue affects users of the Node.js permission model on version v25. In the moment of this vulnerability, network permissions (`--allow-net`) are still in the experimental phase.