DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-109383: CVE-2026-109383: Improper Certificate Validation in Node.js Undici Agent Dispatcher

#security #cve #cybersecurity

CVE-2026-109383: Improper Certificate Validation in Node.js Undici Agent Dispatcher

Vulnerability ID: CVE-2026-109383
CVSS Score: 7.4
Published: 2026-10-27

CVE-2026-109383 (GHSA-2m5v-pch6-74hx) is an improper certificate validation vulnerability (CWE-295) in undici, the official HTTP/1.1 and HTTP/2 client library for Node.js. In affected versions, the Agent constructor clones configuration options using a JSON-based deep clone function (util.deepClone), which executes JSON.parse(JSON.stringify(options)). Because JSON serialization omits function properties, custom certificate validation callbacks passed via the tls configuration option—such as tls.checkServerIdentity—are silently stripped before being passed to origin connection pools. Consequently, connections fall back to standard Node.js TLS validation, bypassing custom certificate pinning or hostname verification rules and allowing an Adversary-in-the-Middle (AitM) with a CA-trusted certificate to intercept and modify traffic.

TL;DR

The Node.js undici HTTP client silently drops custom TLS validation functions (such as checkServerIdentity) passed via the Agent({ tls: { ... } }) option because it uses JSON.parse(JSON.stringify()) to clone options. This bypasses custom certificate pinning, allowing network attackers with valid CA-signed certificates to intercept traffic. Upgrade to undici 6.29.1, 7.30.1, or 8.12.2, or pass TLS callbacks via the connect option instead of tls.

⚠️ Exploit Status: POC

Technical Details

  • Vulnerability Type: CWE-295: Improper Certificate Validation
  • CVSS v3.1 Score: 7.4 High (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
  • EPSS Score: 0.184% (7.93rd Percentile)
  • Affected Component: undici Agent Dispatcher (lib/dispatcher/agent.js)
  • Root Cause: JSON.parse(JSON.stringify(options)) strips function callbacks in tls options
  • Security Impact: Bypass of custom TLS certificate pinning (checkServerIdentity) via AitM
  • Patched Versions: undici 6.29.1, 7.30.1, 8.12.2
  • CISA KEV Status: Not Listed

Affected Systems

  • Node.js Undici HTTP Client Library (versions 4.0.0 through 6.29.0)
  • Node.js Undici HTTP Client Library (versions 7.0.0 through 7.30.0)
  • Node.js Undici HTTP Client Library (versions 8.0.0 through 8.12.1)
  • undici: >= 4.0.0, < 6.29.1 (Fixed in: 6.29.1)
  • undici: >= 7.0.0, < 7.30.1 (Fixed in: 7.30.1)
  • undici: >= 8.0.0, < 8.12.2 (Fixed in: 8.12.2)

Code Analysis

Commit: f75eac0

Preserve tls option callbacks in Agent constructor by destructuring and shallow-copying tls before util.deepClone(options).

File: lib/dispatcher/agent.js
@@ -22,7 +22,7 @@ function defaultFactory (origin, opts) {
 }

 class Agent extends DispatcherBase {
-  constructor ({ factory = defaultFactory, maxOrigins = Infinity, connect, ...options } = {}) {
+  constructor ({ factory = defaultFactory, maxOrigins = Infinity, connect, tls, ...options } = {}) {
     if (typeof factory !== 'function') {
       throw new InvalidArgumentError('factory must be a function.')
     }
@@ -41,7 +41,11 @@ class Agent extends DispatcherBase {
       connect = { ...connect }
     }

-    this[kOptions] = { ...util.deepClone(options), maxOrigins, connect }
+    if (tls && typeof tls !== 'function') {
+      tls = { ...tls }
+    }
+
+    this[kOptions] = { ...util.deepClone(options), maxOrigins, connect, tls }
     this[kFactory] = factory
     this[kClients] = new Map()
     this[kOrigins] = new Set()
Enter fullscreen mode Exit fullscreen mode

Commit: 04cb74b

Backport fix for preserving tls callbacks in Agent constructor to undici v7.x branch.

Commit: 8c59f6b

Backport fix for preserving tls callbacks in Agent constructor to undici v6.x branch.

Commit: bb6cc0a

Bumped v8.12.2 release commit.

Exploit Details

  • GitHub: Official regression test case demonstrating checkServerIdentity bypass prior to patch in test/node-test/agent.js

Mitigation Strategies

  • Upgrade the undici package to a patched release (6.29.1, 7.30.1, or 8.12.2) across all Node.js projects and container images.
  • Migrate TLS configuration parameters from the legacy 'tls' option key to the 'connect' option key in all Agent instantiations.
  • Audit application codebases for custom certificate validation functions (such as checkServerIdentity or pskCallback) passed into undici dispatchers and add automated unit tests verifying that invalid certificates trigger expected rejection errors.

Remediation Steps:

  1. Identify affected versions of undici in your project dependency tree by running 'npm list undici', 'yarn why undici', or 'pnpm why undici'.
  2. Update package.json to require undici >= 6.29.1 (for v6), >= 7.30.1 (for v7), or >= 8.12.2 (for v8) and regenerate lockfiles.
  3. If immediate dependency patching is blocked, refactor Agent initialization code from 'new Agent({ tls: { checkServerIdentity } })' to 'new Agent({ connect: { checkServerIdentity } })'.
  4. Verify that custom certificate pinning callbacks execute as expected by running integration tests that assert connection rejection when an untrusted or unpinned certificate is presented.

References

Read the full report for CVE-2026-109383 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)