CVE-2026-84961

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON.

Undici

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer whose certificate the application's custom checkServerIdentity was written to…

4. Sep 2026

Ausgewertete Quellen

• Hinweis
  https://cna.openjsf.org/security-advisories.html
• NVD
  CVE-2026-84961
• GitHub
  https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3