Node.js HTTP Client Library Vulnerability in undici by Node.js

CVE-2026-87018

What is CVE-2026-87018?

The undici HTTP client library for Node.js experiences a vulnerability where established connections can crash when a TLS 1.2 server renegotiates and presents a different trusted certificate. This flaw occurs because undici's error handler incorrectly assumes that a certificate-altname error will never happen, which leads to a process crash when such an error is encountered. Malicious actors can exploit this vulnerability by controlling an HTTPS endpoint and triggering a server-initiated renegotiation, terminating all in-flight requests. The vulnerability affects undici versions from 4.2.1 to 8.12.1 but has been addressed in subsequent updates. Users are encouraged to upgrade or restrict connections to prevent exploitation.

References