Is CVE-2026-84961 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84961 being exploited in the wild.

How severe is CVE-2026-84961?

High severity, with a CVSS score of 7.4, published 4 September 2026.

Which products and versions are affected?

undici (npm) SEMVER:introduced=7.24.1,fixed=7.29.1.

Is there a fix for CVE-2026-84961?

Yes. undici (npm): upgrade to 7.29.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-84961 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-84961?

Check whether you run undici (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84961: undici BalancedPool TLS certificate validation bypass via dropped connect options

CVE-2026-84961 · Severity: high · CVSS 7.4 · Published 2026-09-04

undici is a popular HTTP client library for Node.js used to make network requests. When using its BalancedPool dispatcher for load-balanced connections, custom TLS certificate validation callbacks (such as checkServerIdentity) are silently discarded, allowing connections to servers with rejected certificates to be accepted if they pass Node's default validation. This could allow attackers to conduct man-in-the-middle attacks or impersonate servers that an application specifically intended to reject.

Technologies: undici (npm). Vendors: npm.

Quick answers

Is CVE-2026-84961 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84961 being exploited in the wild.
How severe is CVE-2026-84961?: High severity, with a CVSS score of 7.4, published 4 September 2026.
Which products and versions are affected?: undici (npm) SEMVER:introduced=7.24.1,fixed=7.29.1.
Is there a fix for CVE-2026-84961?: Yes. undici (npm): upgrade to 7.29.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84961 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-84961?: Check whether you run undici (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

undici (npm): upgrade to 7.29.1 or later
```
npm install undici@7.29.1
```

Technical details

undici's BalancedPool constructor performs a JSON-based deep clone (JSON.parse(JSON.stringify(options))) of its entire options object before forwarding it to upstream Pool instances. Since JSON cannot serialize functions, function-valued options like custom connect or tls callbacks are silently dropped during this cloning process. An attacker in a network position to intercept connections could exploit this to serve a certificate that fails custom validation but passes Node's default hostname and certificate chain checks, achieving a man-in-the-middle attack. The vulnerability affects versions 7.24.1 to 7.29.0 and 8.0.0 to 8.10.1. Other dispatchers (Client, Pool, Agent, RoundRobinPool) extract connect/tls options before cloning and are not affected. Patches are available in versions 7.29.1 and 8.10.2.

Affected products

OpenJS Foundation undici 7.24.1 to 7.29.0, 8.0.0 to 8.10.1

Identifiers

CVE-2026-84961
GHSA-w293-vg96-wgc3

Timeline

2026-09-04: disclosed
2026-09-04: patched: Patches available in versions 7.29.1 and 8.10.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.