{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/undici--7.0.0--7.30.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-109383"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["undici (\u003e= 4.0.0, \u003c 6.29.1)","undici (\u003e= 7.0.0, \u003c 7.30.1)","undici (\u003e= 8.0.0, \u003c 8.12.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eundici's Agent constructor options undergo a JSON-based deep clone before being passed to origin Pools. Because JSON cannot represent functions, custom TLS check callbacks, such as checkServerIdentity, are silently dropped. This results in the omission of additional security validation for applications relying on custom certificate or public-key pinning. TLS connections will default to standard Node.js hostname and chain verification, bypassing more stringent custom policies defined by developers. This affects common entry points like request and fetch, as well as EnvHttpProxyAgent.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eApplications implementing custom checkServerIdentity callbacks for enhanced TLS validation are vulnerable. These applications may accept TLS connections that should have been rejected by the custom policy, provided the connection passes standard Node.js default verification.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade undici to version 6.29.1, 7.30.1, or 8.12.2 to resolve the option handling logic.\u003c/li\u003e\n\u003cli\u003eAudit applications using undici Agent or EnvHttpProxyAgent that implement TLS configuration, specifically checking for the usage of checkServerIdentity or similar custom verification callbacks.\u003c/li\u003e\n\u003cli\u003eAs a workaround, developers should pass TLS options through the connect option instead of the tls option for Agent instances, or use requestTls/proxyTls for EnvHttpProxyAgent destinations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T23:58:42Z","date_published":"2026-10-27T23:58:42Z","id":"https://feed.craftedsignal.io/briefs/2026-10-undici-tls-bypass/","summary":"The undici library fails to enforce custom TLS certificate validation callbacks in Agent constructor options due to a JSON-based cloning mechanism, potentially allowing invalid TLS connections.","title":"undici: TLS certificate validation bypass in Agent (CVE-2026-109383)","url":"https://feed.craftedsignal.io/briefs/2026-10-undici-tls-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Undici (\u003e= 7.0.0, \u003c 7.30.1)","version":"https://jsonfeed.org/version/1.1"}