Undici (>= 4.0.0, < 6.29.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/undici--4.0.0--6.29.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 23:58:42 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgundici: TLS certificate validation bypass in Agent (CVE-2026-109383)https://feed.craftedsignal.io/briefs/2026-10-undici-tls-bypass/Tue, 27 Oct 2026 23:58:42 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-undici-tls-bypass/The undici library fails to enforce custom TLS certificate validation callbacks in Agent constructor options due to a JSON-based cloning mechanism, potentially allowing invalid TLS connections.undici's Agent constructor options undergo a JSON-based deep clone before being passed to origin Pools. Because JSON cannot represent functions, custom TLS check callbacks, such as checkServerIdentity, are silently dropped. This results in the omission of additional security validation for applications relying on custom certificate or public-key pinning. TLS connections will default to standard Node.js hostname and chain verification, bypassing more stringent custom policies defined by developers. This affects common entry points like request and fetch, as well as EnvHttpProxyAgent.

Impact

Applications implementing custom checkServerIdentity callbacks for enhanced TLS validation are vulnerable. These applications may accept TLS connections that should have been rejected by the custom policy, provided the connection passes standard Node.js default verification.

Recommendation

  • Upgrade undici to version 6.29.1, 7.30.1, or 8.12.2 to resolve the option handling logic.
  • Audit applications using undici Agent or EnvHttpProxyAgent that implement TLS configuration, specifically checking for the usage of checkServerIdentity or similar custom verification callbacks.
  • As a workaround, developers should pass TLS options through the connect option instead of the tls option for Agent instances, or use requestTls/proxyTls for EnvHttpProxyAgent destinations.
]]>highadvisory