Undici Vulnerable To TLS Certificate Validation Bypass Via Dropped Tls Options In Agent

Impact undici's "Agent" passes its constructor options through a JSON-based deep clone "JSON.parseJSON.stringify..." before forwarding them to each per-origin "Pool". JSON cannot represent functions, so a caller-supplied "tls" option containing a "checkServerIdentity" callback is silently dropped...

undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

Impact undici's Agent passes its constructor options through a JSON-based deep clone JSON.parseJSON.stringify... before forwarding them to each per-origin Pool. JSON cannot represent functions, so a caller-supplied tls option containing a checkServerIdentity callback is silently dropped before it...

EUVD-2026-102314

undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent...

Node.js < 24.22.1, < 26.12.1 - Improper Certificate Validation via Fullwidth-Digit IP Hostnames (checkServerIdentity bypass)

Improper Certificate Validation via Fullwidth-Digit IP Hostnames checkServerIdentity bypass vulnerability discovered by hasanfleyah in WordPress npm Node.js versions 24.22.1...

Improper Validation of Certificate with Host Mismatch

Overview Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch the checkServerIdentity function in lib/tls.js. An attacker can cause a TLS client to accept a certificate that does not identify the connected peer by supplying a non-canonical...

Improper Validation of Certificate with Host Mismatch Reasoning:

Overview Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch Reasoning: via the checkServerIdentity function in the TLS module. When a client connects using a non-canonical IPv4 hostname such as 0127.0.0.1, hostname normalization can produce a...

Improper Validation of Certificate with Host Mismatch

Overview Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch via the checkServerIdentity function in lib/tls.js. An attacker can bypass certificate hostname checks by getting a TLS client to connect using fullwidth digits representing an IPv4...

SUSE CVE-2026-109383

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent...

Linux Distros Unpatched Vulnerability : CVE-2026-109383

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its...

UBUNTU-CVE-2026-109383

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent...

DEBIAN-CVE-2026-109383

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent...

CVE-2026-109383

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent...

CVE-2026-109383

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent...

CVE-2026-109383 undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent...

CVE-2026-109383

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent...

CVE-2026-109383 undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent...

CVE-2026-109383 undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent...

CVE-2026-109383

The undici HTTP client library for Node.js (versions 4.0.0-6.29.0, 7.0.0-7.30.0, and 8.0.0-8.12.1) is vulnerable to Improper Certificate Validation (CWE-295). The Agent dispatcher performs a JSON-based deep clone of constructor options; since JSON cannot represent functions, any caller-supplied t...

PT-2026-115118

Name of the Vulnerable Software and Affected Versions undici versions 4.0.0 through 6.29.0 undici versions 7.0.0 through 7.30.0 undici versions 8.0.0 through 8.12.1 Description The Agent dispatcher performs a JSON-based deep clone of constructor options before forwarding them to per-origin pools...

CVE-2026-109383: Improper Certificate Validation

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent...