undici EUVD-2026-71494

Three conditions must all be true simultaneously: (1) the application uses undici's BalancedPool dispatcher - not Client, Pool, or Agent; (2) the BalancedPool constructor is called with a function-valued connect or tls option, specifically a checkServerIdentity callback or a custom connector function; (3) the attacker must hold a network MITM position and possess a certificate that satisfies Node.js's default hostname and chain validation. Applications using BalancedPool without any function-valued TLS options are not affected, as their effective TLS configuration is not altered by the JSON clone. The vulnerability does not affect server-side Node.js applications that receive connections; it only affects outbound HTTPS requests made through BalancedPool. No authentication is required of the attacker - only a network vantage point sufficient for MITM.

The vendor CVSS of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) is well-calibrated. AC:H reflects the genuine prerequisite that the attacker must hold a MITM position on the network path and must possess or obtain a certificate that satisfies Node.js default validation - not a trivial bar. The C:H and I:H scores are accurate: a successful MITM against a TLS session yields both plaintext interception and the ability to inject or alter responses. No KEV listing and no public exploit code exist at time of analysis, making this a conditional-but-serious risk rather than an emergency. Real-world exposure is further narrowed by two hard prerequisites: the application must use BalancedPool specifically (not Client, Pool, or Agent), and it must supply function-valued TLS options. Applications using undici without BalancedPool, or BalancedPool without custom TLS callbacks, are entirely unaffected. EPSS data was not provided; the conditional exploitation conditions suggest probability of opportunistic mass exploitation is low, though targeted abuse against specific applications relying on custom certificate pinning or identity validation is plausible.

An attacker with a MITM position between a Node.js application using BalancedPool and its upstream HTTPS endpoint obtains or generates a TLS certificate that passes standard Node.js hostname and chain verification but contains a subject or SAN that the application's custom checkServerIdentity callback was written to reject (e.g., an unexpected organizational unit or an alternative domain not on an application-managed allowlist). Because the callback was silently dropped during BalancedPool initialization, the TLS handshake completes without triggering the custom check, and the application's HTTP traffic is routed through the attacker's server undetected.