Function Handling Flaw in undici's BalancedPool Affects Node.js Applications

CVE-2026-84961

What is CVE-2026-84961?

The vulnerability in undici's BalancedPool constructor allows specific options to be improperly handled due to a deep-clone serialization conducted as JSON. This results in function-valued TLS options being discarded, undermining the intended security checks within applications. Consequently, an attacker could exploit this flaw to present a certificate that should have been rejected by the application, as long as it passes the default hostname and chain checks by Node.js. This issue affects specific versions of undici and requires users to update to the latest secure versions to mitigate this risk.

References