undici EUVD-2026-102314

Exploitation requires that the target application passes a FUNCTION-valued tls option - specifically a custom checkServerIdentity callback used for certificate or public-key pinning - to undici's Agent or EnvHttpProxyAgent (including implicitly via fetch, request, or setGlobalDispatcher, since Agent is the default dispatcher). The flaw only manifests on affected versions (4.0.0-6.29.0, 7.0.0-7.30.0, 8.0.0-8.12.1). Additionally, the attacker must hold a man-in-the-middle position on the connection and present a certificate that still passes Node's DEFAULT hostname and chain validation but would have been rejected by the dropped custom callback. Limiting factors: applications that do NOT use a function-valued tls/checkServerIdentity option are not affected; applications that pass TLS options via connect (or requestTls/proxyTls for proxied destinations) are not affected; and the attacker gains nothing unless they can both intercept traffic and obtain a cert valid under default checks.

This is a genuine but conditional security-control bypass rather than a broad remote-code or data-theft flaw. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, 7.4 HIGH) is internally consistent with the description: no authentication is required of the victim application (PR:N), but AC:H correctly reflects that exploitation is not trivial - the attacker must already hold a man-in-the-middle network position AND present a certificate that passes Node's default hostname and chain validation while only failing the application's custom checkServerIdentity logic. No EPSS score, CISA KEV entry, or POC indicator was supplied, so there is no public-exploit or active-exploitation signal to weigh; this reads as a defense-in-depth regression (certificate/public-key pinning silently disabled) rather than a mass-exploitable internet-facing bug. The practical risk is scoped tightly: only applications that pass a function-valued tls option (e.g., custom checkServerIdentity for pinning) are affected, so despite undici's ubiquity the vulnerable population is a narrow subset. Treat as a priority patch specifically for applications relying on undici-based pinning (TLS clients talking to high-value or MITM-exposed endpoints); for applications not using custom checkServerIdentity, real-world risk is effectively nil.

An application uses undici (directly or via fetch/request/setGlobalDispatcher) with a custom checkServerIdentity callback to pin a specific server certificate or public key. An attacker positioned on the network path (e.g., rogue Wi-Fi, compromised router, or DNS redirection) presents a different certificate that chains to a trusted/mis-issued CA and matches the hostname - normally rejected by the pinning callback, but now silently accepted because the function-valued tls option was dropped during the JSON deep-clone, allowing the attacker to intercept and tamper with the TLS session. No public exploit code was identified in the provided data.