CVE-2026-87018

High · 7.5

CVSS

7.5

EPSS

0.2%

Published

Oct 15, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the code that Node.js applications use to make secure web requests can let a website the application talks to deliberately crash the entire program, stopping all its work until it is restarted.

Exploitation: Remote Unauthenticated
Attacker needs: None
Complexity: Low
Impact: Denial Of Service
Component: Library
Class: Improper Input Validation
Remediation: Upgrade
Effort: Medium
Patch risk: Low

What it actually does

The undici client asserts that a certificate-altname error cannot occur on an established socket during TLS 1.2 renegotiation, but Node.js emits this error when a server presents a valid but hostname-mismatched certificate, turning the peer-controlled error into an uncaught assertion that terminates the process. Both HTTP/1.1 and HTTP/2 paths are affected; TLS 1.3 is unaffected because it lacks renegotiation.

Why it matters to the business

A single malicious or compromised HTTPS endpoint can crash the Node.js process, terminating all in-flight requests and background work; this affects outbound HTTP clients and the global fetch API in Red Hat nodejs24-main and nodejs26-main packages, leading to denial of service for applications that perform outbound HTTPS calls.

How an attack unfolds

An attacker who controls an HTTPS server reachable by the victim application initiates a TLS 1.2 renegotiation after the initial handshake, supplies a second CA-trusted certificate whose hostname does not match the requested host, and triggers the assertion failure in undici's error handler, crashing the client process with no requirement for CA compromise.

How to fix it

Upgrade to undici 6.29.1, 7.30.1, or 8.12.2 or later. For Red Hat packages, update nodejs24-main to 24.21.0-1.5.hum1 or later and nodejs26-main to 26.12.1-0.1.hum1 or later via the referenced RHSA. As a workaround, configure outbound connections to use only TLS 1.3 when target endpoints permit it.

How to confirm the fix worked

Confirm the installed undici or Red Hat Node.js package version meets or exceeds the fixed releases listed above; test by attempting a TLS 1.2 renegotiation against a server that presents a hostname-mismatched certificate and verify the process no longer crashes with an assertion error.

Typical attack path

Victim application establishes an outbound HTTPS connection via undici or global fetch to an attacker-controlled endpoint over TLS 1.2
Server completes initial handshake with a matching certificate
Server initiates renegotiation and presents a different valid certificate whose SAN does not match the requested hostname
Node.js emits a certificate-altname error on the socket
undici's established-socket handler asserts the error code is impossible, causing an uncaught exception that terminates the process

How to detect it

Look for unexpected Node.js process terminations accompanied by assertion failures referencing certificate-altname or socket errors in application logs or core dumps shortly after outbound HTTPS connections; correlate with TLS 1.2 renegotiation events if extended logging is available.

What your security team should do

Apply the Red Hat package updates for nodejs24-main and nodejs26-main immediately given the 14-day publication window
Audit all applications using undici or Node.js fetch for outbound HTTPS calls and schedule upgrades
Where possible, enforce TLS 1.3-only outbound connections to eliminate renegotiation risk
Monitor EPSS and KEV status for any future increase in exploit activity

The record

undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it.

Affected packages

Ecosystem	Package	Introduced	Fixed