CVE-2026-87018: undici denial of service via TLS 1.2 certificate renegotiation

CVE-2026-87018 · Severity: high · CVSS 7.5 · Published 2026-10-15

undici is an HTTP client library for Node.js used to fetch remote content and manage network connections. A malicious or compromised HTTPS server can crash the entire Node.js process by renegotiating the TLS connection and presenting a certificate with a mismatched hostname, terminating all in-flight requests and background work. This affects HTTP clients and Node.js applications using the global fetch() function.

Technologies: undici (npm), OpenJS Foundation Undici. Vendors: npm, OpenJS Foundation.

Quick answers

Is CVE-2026-87018 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-87018 being exploited in the wild.
How severe is CVE-2026-87018?
High severity, with a CVSS score of 7.5, published 15 October 2026.
Which products and versions are affected?
undici (npm) >= 4.2.1, < 6.29.1, SEMVER:introduced=4.2.1,fixed=6.29.1; OpenJS Foundation Undici 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, 8.0.0 through 8.12.1.
Is there a fix for CVE-2026-87018?
Yes. undici (npm): upgrade to 6.29.1 or later. Until then: Restrict outbound connections to TLS 1.3 only by setting connect: { minVersion: 'TLSv1.3', maxVersion: 'TLSv1.3' } on the client or agent, provided target endpoints support TLS 1.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87018 attacked?
It is attacked over the network.
Am I affected by CVE-2026-87018?
Check whether you run undici (npm) or OpenJS Foundation Undici at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • undici (npm): upgrade to 6.29.1 or later
    npm install undici@6.29.1

Restrict outbound connections to TLS 1.3 only by setting connect: { minVersion: 'TLSv1.3', maxVersion: 'TLSv1.3' } on the client or agent, provided target endpoints support TLS 1.3.

Technical details

An uncaught assertion in undici's established-socket error handler fails when Node.js re-runs hostname verification during TLS 1.2 renegotiation and receives an ERR_TLS_CERT_ALTNAME_INVALID error that the code did not expect. The vulnerability affects HTTP/1.1 and HTTP/2 paths in undici versions 4.2.1–6.29.0, 7.0.0–7.30.0, and 8.0.0–8.12.1. Exploitation requires network access to an HTTPS endpoint and no user interaction, but the attacker must control both certificates in the renegotiation sequence (TLS 1.3 is not affected as it does not support renegotiation).

Affected products

  • OpenJS Foundation undici 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, 8.0.0 through 8.12.1

Identifiers

  • CVE-2026-87018
  • GHSA-qrxm-fqhp-jwvm

Timeline

  • 2026-10-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.