Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-84961

CVE-2026-84961CRITICAL

undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  N    9.1   .0015    3.3     —

AFFECTED
  Product  Versions  Fixed
  undici   7.24.1 –  7.29.1

TIMELINE
  Sep 2   Reserved by openjs
  Sep 4   Published (CNA: openjs)
  Sep 15  RESCORED — CVE-2026-84961 (undici). CVSS 7.4 → 9.1 (NVD).

CWE-295 · CNA: openjs · CVSS v3.1 · 2 references · NVD status: Analyzed

Description

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer whose certificate the application's custom checkServerIdentity was written to reject, but which still passes Node's default hostname and chain checks, is accepted when reached through BalancedPool. The Client, Pool, and Agent dispatchers are not affected because they extract the connect and tls options before cloning. This affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2, and only when the application supplies a function-valued connect or tls option to BalancedPool. Users should upgrade to undici 7.29.1 or 8.10.2.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
September 2, 2026	Reserved	Reserved by openjs
September 4, 2026	Published	Published (CNA: openjs)
September 15, 2026	RESCORED	RESCORED — CVE-2026-84961 (undici). CVSS 7.4 → 9.1 (NVD).

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
undici	undici	—	7.24.1	7.29.1

Weaknesses

CWE-295

References (2)

https://cna.openjsf.org/security-advisories.html [Third Party Advisory]
https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3 [Mitigation, Vendor Advisory]

Authoritative record: CVE-2026-84961 at cve.org

Vendors: undici

Weaknesses: CWE-295

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-84961 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.