CVE-2026-84961
Received Received - Intake

Function Loss in BalancedPool TLS Options

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: openjs

Description
undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer whose certificate the application's custom checkServerIdentity was written to reject, but which still passes Node's default hostname and chain checks, is accepted when reached through BalancedPool. The Client, Pool, and Agent dispatchers are not affected because they extract the connect and tls options before cloning. This affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2, and only when the application supplies a function-valued connect or tls option to BalancedPool. Users should upgrade to undici 7.29.1 or 8.10.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-84961
EUVD
EUVD-2026-71494

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
undici undici to 7.29.1 (inc)
undici undici to 8.10.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the undici library's BalancedPool constructor. It involves a deep-clone process that serializes options to JSON, which cannot represent functions. Any function-valued TLS options, like custom certificate checks, are discarded before reaching the TLS layer. This allows invalid certificates to be accepted if they pass default checks.

Detection Guidance

This vulnerability affects undici versions between 7.24.1-7.29.1 and 8.0.0-8.10.2 when BalancedPool is used with function-valued TLS options. Check your undici version with 'npm list undici' or 'node -e "console.log(require('undici/package.json').version)"'. If affected, update to version 7.29.1 or 8.10.2.

Impact Analysis

If you use undici versions 7.24.1 to 7.29.1 or 8.0.0 to 8.10.2 with BalancedPool and supply function-valued TLS options, attackers could bypass certificate validation. This may lead to man-in-the-middle attacks or unauthorized data access if malicious servers are trusted.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized TLS connections to be accepted due to discarded security checks. If an application relies on custom checkServerIdentity functions to enforce certificate validation, this flaw may cause non-compliant certificates to be accepted, violating data protection requirements.

Mitigation Strategies

Upgrade undici to version 7.29.1 or 8.10.2 or later. If immediate upgrade is not possible, avoid using BalancedPool with function-valued TLS options like checkServerIdentity or custom connectors.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84961. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart