undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

{
  "id": "c8188479d6f876888d2944a7a9f685eaf640a3150a954374cfcf5de4a37287ba",
  "url": "https://osv.dev/vulnerability/GHSA-2m5v-pch6-74hx",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent",
    "summary": "### Impact undici's `Agent` passes its constructor options through a JSON-based deep clone (`JSON.parse(JSON.stringify(...))`) before forwarding them to each per-origin `Pool`. JSON cannot represent functions, so a caller-supplied `tls` option containing a `checkServerIdentity` callback is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom `checkServerIdentity` was written to reject, but which passes Node's default hostname and chain checks, is silently accepted when the request is made through `Agent`. Because `Agent` is the default dispatcher behind `request`, `fetch`, and `setGlobalDispatcher`, this is the path most applications use. `EnvHttpProxyAgent` is also affected on its direct and `NO_PROXY` routes, which delegate to an internal `Agent`. Only applications that pass a function-valued `tls` option (such as a custom `checkServerIdentity` for certificate or public-key pinning) are affected. Passing the same options through `connect` is not affected. This is the `Agent` counterpart of the `BalancedPool` certificate validation bypass fixed in CVE-2026-84961. ### Patches Upgrade to undici `6.29.1`, `7.30.1`, or `8.12.2`. `Agent` now preserves the `tls` option outside the JSON clone, so custom TLS verification callbacks are forwarded to each origin unchanged. ### Workarounds Pass the TLS options through `connect` instead of `tls`. For proxied `EnvHttpProxyAgent` destinations, use `requestTls` / `proxyTls`.",
    "evidence": "osv:GHSA-2m5v-pch6-74hx",
    "products": [
      {
        "name": {
          "value": "undici",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.29.1",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "undici",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "7.30.1",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "undici",
          "evidence": "/affected/2/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "8.12.2",
            "evidence": "/affected/2/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "GHSA-2m5v-pch6-74hx",
      "aliases": [
        "CVE-2026-109383",
        "GHSA-2m5v-pch6-74hx"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "4.0.0"
                },
                {
                  "fixed": "6.29.1"
                }
              ]
            }
          ],
          "package": {
            "name": "undici",
            "purl": "pkg:npm/undici",
            "ecosystem": "npm"
          },
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-2m5v-pch6-74hx/GHSA-2m5v-pch6-74hx.json"
          }
        },
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "7.0.0"
                },
                {
                  "fixed": "7.30.1"
                }
              ]
            }
          ],
          "package": {
            "name": "undici",
            "purl": "pkg:npm/undici",
            "ecosystem": "npm"
          },
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-2m5v-pch6-74hx/GHSA-2m5v-pch6-74hx.json"
          }
        },
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "8.0.0"
                },
                {
                  "fixed": "8.12.2"
                }
              ]
            }
          ],
          "package": {
            "name": "undici",
            "purl": "pkg:npm/undici",
            "ecosystem": "npm"
          },
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-2m5v-pch6-74hx/GHSA-2m5v-pch6-74hx.json"
          }
        }
      ],
      "modified": "2026-10-27T19:15:22.407771210Z",
      "provider": "osv",
      "references": [
        "https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-109383",
        "https://github.com/nodejs/undici/commit/04cb74b1db131ff8f5b4557dce811cbf5f4664b4",
        "https://github.com/nodejs/undici/commit/8c59f6b302898cb2e9b0f7962cd7212b6e597c9f",
        "https://github.com/nodejs/undici/commit/f75eac00ac177f7b2e6c8bfbd52d4113164286e6",
        "https://cna.openjsf.org/security-advisories.html",
        "https://github.com/nodejs/undici",
        "https://github.com/nodejs/undici/releases/tag/v6.29.1",
        "https://github.com/nodejs/undici/releases/tag/v7.30.1",
        "https://github.com/nodejs/undici/releases/tag/v8.12.2"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-295"
        ],
        "severity": "HIGH",
        "github_reviewed": true,
        "nvd_published_at": "2026-10-15T19:17:20Z",
        "github_reviewed_at": "2026-10-27T19:02:26Z"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-109383",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/database_specific/severity"
  },
  "source_id": "core-osv",
  "document_id": 484992,
  "published_at": "2026-10-27T19:02:26+00:00"
}