Cloudanix VulnDB

CVE-2026-109383

High · 7.4

CVSS

7.4

EPSS

0.2%

Published

Oct 15, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in a common helper used by Node.js programs to make secure web requests can cause the software to trust website certificates it was supposed to reject, potentially letting attackers read private data in transit.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Data Exposure
Component
Library
Class
Cryptographic Weakness
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Agent dispatcher JSON-clones constructor options, silently dropping any function-valued tls.checkServerIdentity callback before it reaches TLS, so only Node's default hostname/chain validation is performed.

Why it matters to the business

Node.js applications using undici (directly or via fetch/request) may accept TLS certificates an administrator intended to reject, enabling undetected interception of traffic to external services; the issue affects widely used Red Hat Node.js packages with fixes already available.

How an attack unfolds

An attacker positioned as a network intermediary presents a certificate that satisfies Node's built-in checks but would have been rejected by the application's custom checkServerIdentity; because the callback is dropped, the connection succeeds and encrypted traffic is exposed.

How to fix it

Upgrade undici to 6.29.1, 7.30.1 or 8.12.2 (or later) or apply the Red Hat updates nodejs24-main to 24.21.0-1.5.hum1 and nodejs26-main to 26.12.1-0.1.hum1. As a workaround, supply TLS options via the connect option instead of tls, or use requestTls/proxyTls for proxied destinations.

How to confirm the fix worked

Confirm the installed undici or Red Hat Node.js package version matches a fixed release; exercise a request that supplies a rejecting checkServerIdentity and verify the callback is invoked and the connection fails as expected.

Typical attack path

  1. Place attacker-controlled system on the path between the Node.js application and the intended origin
  2. Present a certificate that passes default Node TLS validation but would fail the dropped custom callback
  3. Initiate an HTTPS request through undici Agent, fetch, or request so the origin pool accepts the certificate
  4. Decrypt or modify traffic that should have been rejected

How to detect it

Review application source and dependency manifests for use of undici Agent or global dispatchers with custom tls options; inspect outbound TLS connection logs for origins that should have been rejected by custom validation logic; correlate unexpected successful handshakes with certificate pinning or public-key pinning code paths.

What your security team should do

  • Apply the listed Red Hat package updates immediately on all systems running the affected Node.js streams
  • Audit application code for any custom tls.checkServerIdentity usage and migrate options to connect/requestTls where necessary
  • Add undici version checks to dependency scanners and CI pipelines
  • Monitor for future undici releases and schedule routine library updates

The record

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent functions, a caller-supplied tls option containing a checkServerIdentity callback is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reject, but which passes Node's default hostname and chain checks, is silently accepted. Because Agent is the default dispatcher behind request, fetch, and setGlobalDispatcher, this affects the path most applications use, and EnvHttpProxyAgent is affected on its direct and no-proxy routes as well, while only applications that pass a function-valued tls option such as a custom checkServerIdentity for certificate or public-key pinning are at risk. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which preserve the tls option outside the JSON clone so custom verification callbacks are forwarded unchanged, and users should upgrade to one of those versions or later. As a workaround, pass the TLS options through connect instead of tls, or for proxied destinations use requestTls and proxyTls.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities