CVE-2026-109383

undici is an HTTP client library for Node.js.

Undici

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent functions, a caller-supplied tls option containing a checkServerIdentity callback is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom…

15. Okt 2026

Ausgewertete Quellen

• Hersteller
  https://cna.openjsf.org/security-advisories.html
• NVD
  CVE-2026-109383
• GitHub
  https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx