# CVE-2026-84961: undici BalancedPool TLS certificate validation bypass via dropped connect options

Source: https://junglewise.ai/threats/cve-2026-84961-undici-balancedpool-tls-certificate-validation-bypass-via-dropped  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-84961 · Severity: high · CVSS 7.4 · Published 2026-09-04

undici is a popular HTTP client library for Node.js used to make network requests. When using its BalancedPool dispatcher for load-balanced connections, custom TLS certificate validation callbacks (such as checkServerIdentity) are silently discarded, allowing connections to servers with rejected certificates to be accepted if they pass Node's default validation. This could allow attackers to conduct man-in-the-middle attacks or impersonate servers that an application specifically intended to reject.

Technologies: [undici (npm)](https://junglewise.ai/threats/technologies/undici). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-84961 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84961 being exploited in the wild.

**How severe is CVE-2026-84961?** High severity, with a CVSS score of 7.4, published 4 September 2026.

**Which products and versions are affected?** undici (npm) SEMVER:introduced=7.24.1,fixed=7.29.1.

**Is there a fix for CVE-2026-84961?** Yes. undici (npm): upgrade to 7.29.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84961 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-84961?** Check whether you run undici (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- undici (npm): upgrade to 7.29.1 or later

  ```sh
  npm install undici@7.29.1
  ```


## Technical details

undici's BalancedPool constructor performs a JSON-based deep clone (JSON.parse(JSON.stringify(options))) of its entire options object before forwarding it to upstream Pool instances. Since JSON cannot serialize functions, function-valued options like custom connect or tls callbacks are silently dropped during this cloning process. An attacker in a network position to intercept connections could exploit this to serve a certificate that fails custom validation but passes Node's default hostname and certificate chain checks, achieving a man-in-the-middle attack. The vulnerability affects versions 7.24.1 to 7.29.0 and 8.0.0 to 8.10.1. Other dispatchers (Client, Pool, Agent, RoundRobinPool) extract connect/tls options before cloning and are not affected. Patches are available in versions 7.29.1 and 8.10.2.

## Affected products

- OpenJS Foundation undici 7.24.1 to 7.29.0, 8.0.0 to 8.10.1

## Identifiers

- CVE-2026-84961
- GHSA-w293-vg96-wgc3

## Timeline

- 2026-09-04: disclosed
- 2026-09-04: patched: Patches available in versions 7.29.1 and 8.10.2

## References

- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
- [https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3](https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3)

## Related threats

- [undici HTTP client denial of service in decompress interceptor](https://junglewise.ai/threats/cve-2026-87029-undici-is-an-http-client-library-for-node-js-in-versions-7-15-0)
- [undici denial of service via TLS 1.2 certificate renegotiation](https://junglewise.ai/threats/cve-2026-87018-undici-is-an-http-client-library-for-node-js-in-versions-4-2-1)
- [undici WebSocket client denial of service via unbounded PONG buffering](https://junglewise.ai/threats/cve-2026-109932-undici-is-an-http-client-library-for-node-js-in-versions-5-15-0)
- [undici EventSource memory exhaustion denial of service](https://junglewise.ai/threats/cve-2026-109924-undici-is-an-http-client-library-for-node-js-in-versions-6-5-0)
- [undici HTTP client denial of service via excessive content-encodings](https://junglewise.ai/threats/cve-2026-109869-undici-is-an-http-client-library-for-node-js-in-versions-6-23-0)