CVE-2026-109383: undici HTTP client TLS certificate validation bypass in Agent

CVE-2026-109383 · Severity: high · CVSS 7.4 · Published 2026-10-15

undici is an HTTP client library used by Node.js applications to make web requests. A flaw causes the library to silently drop custom TLS certificate validation callbacks when using its default Agent dispatcher, allowing connections to servers with certificates that should have been rejected. This affects applications relying on custom certificate pinning or other validation logic, potentially enabling man-in-the-middle attacks.

Technologies: undici (npm), OpenJS Foundation Undici. Vendors: npm, OpenJS Foundation.

Quick answers

Is CVE-2026-109383 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-109383 being exploited in the wild.
How severe is CVE-2026-109383?
High severity, with a CVSS score of 7.4, published 15 October 2026.
Which products and versions are affected?
undici (npm) >= 4.0.0, < 6.29.1, SEMVER:introduced=4.0.0,fixed=6.29.1; OpenJS Foundation Undici 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1.
Is there a fix for CVE-2026-109383?
Yes. undici (npm): upgrade to 6.29.1 or later. Until then: Pass TLS options through the connect option instead of tls. For proxied EnvHttpProxyAgent destinations, use requestTls or proxyTls instead. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109383 attacked?
It is attacked over the network.
Am I affected by CVE-2026-109383?
Check whether you run undici (npm) or OpenJS Foundation Undici at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • undici (npm): upgrade to 6.29.1 or later
    npm install undici@6.29.1

Pass TLS options through the connect option instead of tls. For proxied EnvHttpProxyAgent destinations, use requestTls or proxyTls instead.

Technical details

The Agent dispatcher serializes constructor options via JSON.parse(JSON.stringify(...)), which cannot represent function types—causing a custom checkServerIdentity callback in the tls option to be silently dropped before reaching the TLS layer. Affected versions rely on this broken path by default; only applications passing function-valued tls options (custom checkServerIdentity, certificate pinning) are impacted. The fix preserves tls options outside the JSON clone to ensure callbacks are forwarded unchanged.

Affected products

  • OpenJS Foundation undici 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1

Identifiers

  • CVE-2026-109383
  • GHSA-2m5v-pch6-74hx

Timeline

  • 2026-10-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.