Undici (>= 8.0.0, < 8.12.2) - CraftedSignal Threat Feed

undici: TLS certificate validation bypass in Agent (CVE-2026-109383)

hello@craftedsignal.io — Tue, 27 Oct 2026 23:58:42 +0000

undici's Agent constructor options undergo a JSON-based deep clone before being passed to origin Pools. Because JSON cannot represent functions, custom TLS check callbacks, such as checkServerIdentity, are silently dropped. This results in the omission of additional security validation for applications relying on custom certificate or public-key pinning. TLS connections will default to standard Node.js hostname and chain verification, bypassing more stringent custom policies defined by developers. This affects common entry points like request and fetch, as well as EnvHttpProxyAgent.

Impact

Applications implementing custom checkServerIdentity callbacks for enhanced TLS validation are vulnerable. These applications may accept TLS connections that should have been rejected by the custom policy, provided the connection passes standard Node.js default verification.

Recommendation

Upgrade undici to version 6.29.1, 7.30.1, or 8.12.2 to resolve the option handling logic.
Audit applications using undici Agent or EnvHttpProxyAgent that implement TLS configuration, specifically checking for the usage of checkServerIdentity or similar custom verification callbacks.
As a workaround, developers should pass TLS options through the connect option instead of the tls option for Agent instances, or use requestTls/proxyTls for EnvHttpProxyAgent destinations.

undici: Cache poisoning and cross-user data disclosure via cross-origin redirects (CVE-2026-109829)

hello@craftedsignal.io — Tue, 27 Oct 2026 23:58:35 +0000

The undici HTTP client library contains a vulnerability (CVE-2026-109829) in its cache interceptor when used in conjunction with the redirect interceptor. Specifically, when an originless Agent is configured with the interceptor composition compose(redirect(), cache()) and a shared cache, the cache key is generated based on the original request URL before the redirect occurs.

This allows the response from a cross-origin redirect to be stored under the key of the initial trusted URL. An attacker controlling the redirect target can poison the cache with malicious content, or cause private, user-specific data to be stored and served to unauthenticated callers if the redirect path contains sensitive information. The vulnerability affects versions 7.x (< 7.30.1) and 8.x (< 8.12.2).

Impact

Successful exploitation allows for persistent cache poisoning of trusted URLs or the disclosure of sensitive, private data across users within the same shared cache instance.

Recommendation

Upgrade undici to version 7.30.1 or 8.12.2 immediately.
If upgrading is not immediately possible, update the interceptor composition order to compose(cache(), redirect()).
Ensure the use of per-origin dispatchers (Client or Pool) or disable shared caching for requests that are susceptible to redirects.