HTTP Client Library Vulnerability in undici Affects Node.js

CVE-2026-109383

What is CVE-2026-109383?

The undici HTTP client library for Node.js is vulnerable due to the mishandling of TLS options. In specific versions, the constructor options are deep-cloned using JSON, which does not support function serialization. Consequently, important options like a caller-supplied checkServerIdentity callback are disregarded, potentially allowing malicious TLS peers to be accepted incorrectly. This issue impacts numerous applications relying on the library's default dispatcher, making it critical for users to upgrade to patched versions to maintain secure TLS connections. As a temporary fix, it is recommended to pass TLS options differently or utilize alternative connection methods.

References