CVE-2026-84961

🗓️ 04 Sep 2026 17:17:02Reported by [email protected]Type

TLS validation bypass in undici BalancedPool drops function-valued TLS options via JSON deep-clone.

Reporter	Title	Published	Views	Family All 145
IBM Security Bulletins	Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in undici (CVE-2026-18149, CVE-2026-18540, CVE-2026-19534, CVE-2026-84890, CVE-2026-84933, CVE-2026-84947, CVE-2026-84961, CVE-2026-85008, CVE-2026-85014, CVE-2026-85024)	15 Oct 202620:17	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator in IBM Integration is vulnerable to multiple vulnerabilities in undici	14 Oct 202615:07	–	ibm
Tenable Nessus	Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-3107)	29 Sep 202600:00	–	nessus
Tenable Nessus	AlmaLinux 10 : nodejs24 (ALSA-2026:73428)	30 Sep 202600:00	–	nessus
Tenable Nessus	AlmaLinux 9 : nodejs:24 (ALSA-2026:73838)	15 Oct 202600:00	–	nessus
Tenable Nessus	AlmaLinux 8 : nodejs:24 (ALSA-2026:74085)	14 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 10.2 [CIQ] Security Update: nodejs24 / nodejs24-debuginfo / nodejs24-debugsource / etc Multiple Vulnerabilities (crlsa-2026_73428)	2 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2026_74085)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 9 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2026_73838)	1 Oct 202600:00	–	nessus
Tenable Nessus	MiracleLinux 8 : nodejs:24 (AXSA:2026-1972:01)	6 Oct 202600:00	–	nessus

NVD

Node

nodejs undiciRange7.24.1–7.29.1node.js

nodejs undiciRange8.0.0–8.10.2node.js

Source	Link
cna	www.cna.openjsf.org/security-advisories.html
github	www.github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3

15 Sep 2026 14:29Current

CVSS 3.17.4 - 9.1

EPSS0.00146

SSVC