---
id: "CVE-2026-109383"
kind: "vulnerability"
aliases: ["CVE-2026-109383", "GHSA-2m5v-pch6-74hx"]
title: "undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent"
severity: "critical"
cvss: 9.1
epss: 0.00184
exploited: false
status: "open"
category: "package"
products: [{"name": "undici", "fixed": ["6.29.1"], "affected": ">= 4.0.0, < 6.29.1", "ecosystem": "npm"}, {"name": "undici", "fixed": ["7.30.1"], "affected": ">= 7.0.0, < 7.30.1", "ecosystem": "npm"}, {"name": "undici", "fixed": ["8.12.2"], "affected": ">= 8.0.0, < 8.12.2", "ecosystem": "npm"}, {"name": "nodejs undici", "fixed": ["6.29.1"], "affected": ">= 4.0.0, < 6.29.1", "ecosystem": "vendor"}, {"name": "nodejs undici", "fixed": ["7.30.1"], "affected": ">= 7.0.0, < 7.30.1", "ecosystem": "vendor"}, {"name": "nodejs undici", "fixed": ["8.12.2"], "affected": ">= 8.0.0, < 8.12.2", "ecosystem": "vendor"}]
ecosystems: ["npm", "vendor"]
tags: ["certificate-pinning", "cwe-295", "fetch", "node", "npm", "package", "undici"]
not_affected_if: ["connect-options-only", "default-tls-config", "no-custom-checkserveridentity"]
published_at: "2026-10-15T19:17:20+00:00"
first_seen_at: "2026-10-27T19:04:55+00:00"
updated_at: "2026-10-27T19:33:18+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-2m5v-pch6-74hx", "first_seen_at": "2026-10-27T19:04:55+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109383", "first_seen_at": "2026-10-27T19:33:18+00:00"}]
---

# undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

undici's Agent drops a caller-supplied checkServerIdentity callback from its tls options because it deep-clones options through JSON. A server certificate that the custom check was meant to reject is then accepted when requests go through Agent, the default dispatcher for fetch and request.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:undici affected >= 4.0.0, < 6.29.1 fixed 6.29.1
- npm:undici affected >= 7.0.0, < 7.30.1 fixed 7.30.1
- npm:undici affected >= 8.0.0, < 8.12.2 fixed 8.12.2
- vendor:nodejs undici affected >= 4.0.0, < 6.29.1 fixed 6.29.1
- vendor:nodejs undici affected >= 7.0.0, < 7.30.1 fixed 7.30.1
- vendor:nodejs undici affected >= 8.0.0, < 8.12.2 fixed 8.12.2

## How to check

- Search the codebase for `checkServerIdentity` or other function-valued `tls` options passed to `Agent`, `EnvHttpProxyAgent` or `setGlobalDispatcher`.
- Run `npm ls undici` and compare the installed version against `6.29.1`, `7.30.1` or `8.12.2`.

## Fix

- Upgrade undici to `6.29.1`, `7.30.1` or `8.12.2` on the line you are on.
- Until upgraded, pass TLS options through `connect` instead of `tls`; for proxied `EnvHttpProxyAgent` destinations use `requestTls` / `proxyTls`.

## Timeline

- 2026-10-27T19:04:55+00:00 ghsa https://github.com/advisories/GHSA-2m5v-pch6-74hx
- 2026-10-27T19:33:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109383

## From the sources

### Impact

undici's `Agent` passes its constructor options through a JSON-based deep clone (`JSON.parse(JSON.stringify(...))`) before forwarding them to each per-origin `Pool`. JSON cannot represent functions, so a caller-supplied `tls` option containing a `checkServerIdentity` callback is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom `checkServerIdentity` was written to reject, but which passes Node's default hostname and chain checks, is silently accepted when the request is made through `Agent`. Because `Agent` is the default dispatcher behind `request`, `fetch`, and `setGlobalDispatcher`, this is the path most applications use. `EnvHttpProxyAgent` is also affected on its direct and `NO_PROXY` routes, which delegate to an internal `Agent`.

Only applications that pass a function-valued `tls` option (such as a custom `checkServerIdentity` for certificate or public-key pinning) are affected. Passing the same options through `connect` is not affected. This is the `Agent` counterpart of the `BalancedPool` certificate validation bypass fixed in CVE-2026-84961.

### Patches

Upgrade to undici `6.29.1`, `7.30.1`, or `8.12.2`. `Agent` now preserves the `tls` option outside the JSON clone, so custom TLS verification callbacks are forwarded to each origin unchanged.

### Workarounds

Pass the TLS options through `connect` instead of `tls`. For proxied `EnvHttpProxyAgent` destinations, use `requestTls` / `proxyTls`.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_