CVE-2026-84961 undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector...

CVE-2026-84961

undici's BalancedPool constructor deep-clones its options object via JSON serialization, which silently drops function-valued TLS options such as a custom checkServerIdentity callback or a custom connector in the connect option. When these are lost, a peer presenting a certificate that Node's def...

PT-2026-85804

Name of the Vulnerable Software and Affected Versions undici versions 7.24.1 through 7.29.0 undici versions 8.0.0 through 8.10.1 Description The BalancedPool constructor uses an internal deep-clone process that serializes and reparses the options object as JSON. Since JSON does not support...

CVE-2026-84961: Improper Certificate Validation

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector...

Improper Handling of Unicode Encoding

Overview Affected versions of this package are vulnerable to Improper Handling of Unicode Encoding in the checkServerIdentity function in lib/tls.js, which does not normalize an internationalized hostname to ASCII before matching it against certificate names. An attacker presenting a certificate...

CVE-2026-40992

Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected. Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4...

PT-2020-15476 · Jenkins · Jenkins Mailer Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Mailer Plugin versions 1.32 and earlier Description: The issue is related to the lack of hostname validation when connecting to the configured SMTP server. This could be exploited using a man-in-the-middle attack to intercept...