CVE-2026-84961

A flaw was found in undici's BalancedPool component. This vulnerability allows a remote attacker to bypass Transport Layer Security TLS certificate validation. The BalancedPool constructor incorrectly processes its options, silently discarding custom certificate validation functions. Consequently...

CVE-2026-84961

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector...

CVE-2026-84961

CVE-2026-84961 affects undici , the Node.js HTTP client library. The BalancedPool constructor passes its entire options object through an internal JSON deep-clone , which silently discards any function-valued TLS options (e.g., a custom checkServerIdentity callback or a custom connector in the co...

EUVD-2026-71494

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector...

CVE-2026-84961 undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector...