{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/undici--8.0.0--8.12.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-109383"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["undici (\u003e= 4.0.0, \u003c 6.29.1)","undici (\u003e= 7.0.0, \u003c 7.30.1)","undici (\u003e= 8.0.0, \u003c 8.12.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eundici's Agent constructor options undergo a JSON-based deep clone before being passed to origin Pools. Because JSON cannot represent functions, custom TLS check callbacks, such as checkServerIdentity, are silently dropped. This results in the omission of additional security validation for applications relying on custom certificate or public-key pinning. TLS connections will default to standard Node.js hostname and chain verification, bypassing more stringent custom policies defined by developers. This affects common entry points like request and fetch, as well as EnvHttpProxyAgent.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eApplications implementing custom checkServerIdentity callbacks for enhanced TLS validation are vulnerable. These applications may accept TLS connections that should have been rejected by the custom policy, provided the connection passes standard Node.js default verification.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade undici to version 6.29.1, 7.30.1, or 8.12.2 to resolve the option handling logic.\u003c/li\u003e\n\u003cli\u003eAudit applications using undici Agent or EnvHttpProxyAgent that implement TLS configuration, specifically checking for the usage of checkServerIdentity or similar custom verification callbacks.\u003c/li\u003e\n\u003cli\u003eAs a workaround, developers should pass TLS options through the connect option instead of the tls option for Agent instances, or use requestTls/proxyTls for EnvHttpProxyAgent destinations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T23:58:42Z","date_published":"2026-10-27T23:58:42Z","id":"https://feed.craftedsignal.io/briefs/2026-10-undici-tls-bypass/","summary":"The undici library fails to enforce custom TLS certificate validation callbacks in Agent constructor options due to a JSON-based cloning mechanism, potentially allowing invalid TLS connections.","title":"undici: TLS certificate validation bypass in Agent (CVE-2026-109383)","url":"https://feed.craftedsignal.io/briefs/2026-10-undici-tls-bypass/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:nodejs:undici:*:*:*:*:*:*:*:*","cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-109829"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["undici (\u003c 7.30.1)","undici (\u003e= 8.0.0, \u003c 8.12.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Node.js"],"content_html":"\u003cp\u003eThe undici HTTP client library contains a vulnerability (CVE-2026-109829) in its cache interceptor when used in conjunction with the redirect interceptor. Specifically, when an originless Agent is configured with the interceptor composition \u003ccode\u003ecompose(redirect(), cache())\u003c/code\u003e and a shared cache, the cache key is generated based on the original request URL before the redirect occurs.\u003c/p\u003e\n\u003cp\u003eThis allows the response from a cross-origin redirect to be stored under the key of the initial trusted URL. An attacker controlling the redirect target can poison the cache with malicious content, or cause private, user-specific data to be stored and served to unauthenticated callers if the redirect path contains sensitive information. The vulnerability affects versions 7.x (\u0026lt; 7.30.1) and 8.x (\u0026lt; 8.12.2).\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for persistent cache poisoning of trusted URLs or the disclosure of sensitive, private data across users within the same shared cache instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003eundici\u003c/code\u003e to version \u003ccode\u003e7.30.1\u003c/code\u003e or \u003ccode\u003e8.12.2\u003c/code\u003e immediately.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately possible, update the interceptor composition order to \u003ccode\u003ecompose(cache(), redirect())\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eEnsure the use of per-origin dispatchers (\u003ccode\u003eClient\u003c/code\u003e or \u003ccode\u003ePool\u003c/code\u003e) or disable shared caching for requests that are susceptible to redirects.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T23:58:35Z","date_published":"2026-10-27T23:58:35Z","id":"https://feed.craftedsignal.io/briefs/2026-10-undici-cache-poisoning/","summary":"The undici library is vulnerable to cache poisoning and unauthorized cross-user data disclosure due to improper cache key generation when using shared cache interceptors after redirect handlers.","title":"undici: Cache poisoning and cross-user data disclosure via cross-origin redirects (CVE-2026-109829)","url":"https://feed.craftedsignal.io/briefs/2026-10-undici-cache-poisoning/"}],"language":"en","title":"CraftedSignal Threat Feed - Undici (\u003e= 8.0.0, \u003c 8.12.2)","version":"https://jsonfeed.org/version/1.1"}