Executive brief
undici is a popular HTTP client library for Node.js used to make network requests. When using its BalancedPool dispatcher for load-balanced connections, custom TLS certificate validation callbacks (such as checkServerIdentity) are silently discarded, allowing connections to servers with rejected certificates to be accepted if they pass Node's default validation. This could allow attackers to conduct man-in-the-middle attacks or impersonate servers that an application specifically intended to reject.
Technical details
undici's BalancedPool constructor performs a JSON-based deep clone (JSON.parse(JSON.stringify(options))) of its entire options object before forwarding it to upstream Pool instances. Since JSON cannot serialize functions, function-valued options like custom connect or tls callbacks are silently dropped during this cloning process. An attacker in a network position to intercept connections could exploit this to serve a certificate that fails custom validation but passes Node's default hostname and certificate chain checks, achieving a man-in-the-middle attack. The vulnerability affects versions 7.24.1 to 7.29.0 and 8.0.0 to 8.10.1. Other dispatchers (Client, Pool, Agent, RoundRobinPool) extract connect/tls options before cloning and are not affected. Patches are available in versions 7.29.1 and 8.10.2.
Affected products
- OpenJS Foundation undici 7.24.1 to 7.29.0, 8.0.0 to 8.10.1
Timeline
- 2026-09-04: disclosed
- 2026-09-04: patched: Patches available in versions 7.29.1 and 8.10.2