undici CVE-2026-87018

Exploitation requires the undici/fetch client to establish an HTTPS connection to an endpoint the attacker controls or has compromised, and that connection must use TLS 1.2 - TLS 1.3 is explicitly unaffected because it does not support renegotiation. The malicious server must perform a post-handshake renegotiation presenting a second CA-trusted certificate whose hostname does not match the requested host; two ordinary valid certificates suffice and no CA compromise is needed. Both HTTP/1.1 and HTTP/2 paths are affected. The principal limiting factor is that the victim must send a request to the attacker-influenced endpoint, so impact concentrates on applications that fetch attacker-controllable URLs; the documented mitigation is to restrict outbound connections to TLS 1.3 where endpoints support it, or upgrade to undici 6.29.1 / 7.30.1 / 8.12.2 or later.

This is a genuine availability risk whose practical severity depends heavily on deployment context, not a purely theoretical high-CVSS issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) correctly captures a network-reachable, unauthenticated, availability-only impact (CWE-248, uncaught exception). The crash is a full Node.js process termination - not a single dropped request - so a single server-initiated TLS 1.2 renegotiation takes down all in-flight requests and background work in the process, which amplifies the real-world impact of an 'availability-only' bug. No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit referenced, so exploitation status is 'no public exploit identified at time of analysis.' The key mitigating factor absent from the raw CVSS score is directional: the victim client must initiate (or be induced to initiate) an HTTPS request to an endpoint the attacker controls or has compromised, over TLS 1.2. That makes mass, untargeted exploitation less likely than the AV:N/AC:L vector alone suggests, but it is highly relevant to systems that fetch attacker-influenceable URLs (webhooks, SSRF-reachable targets, link previews, outbound proxies). Note the vector does not fully express the dependency on reaching a malicious endpoint; verify applicability against your outbound-request patterns.

An application uses undici (or Node's global fetch, which is backed by undici) to make outbound HTTPS requests to a URL an attacker can influence or host - for example a webhook target, link-preview fetcher, or SSRF-reachable endpoint. The malicious server negotiates TLS 1.2, completes the handshake, then renegotiates and presents a second, CA-trusted certificate whose hostname does not match the request, causing Node to emit a certificate-altname error that trips undici's assertion and crashes the entire Node.js process. No public proof-of-concept is referenced, but the attack requires only two ordinary valid certificates and no CA compromise.