CVE-2026-84961: 
Grafana Analyse et atténuation des vulnérabilités

CVE-2026-84961 is a TLS certificate validation bypass vulnerability in undici's BalancedPool dispatcher that allows network-based man-in-the-middle attacks by silently discarding custom TLS validation callbacks. The root cause is that BalancedPool's constructor deep-clones its options object via JSON.parse(JSON.stringify(...)), which cannot serialize JavaScript functions, causing any function-valued connect or tls option (e.g., checkServerIdentity) to be silently dropped before reaching the TLS layer. Affected versions are undici 7.24.1 up to (but not including) 7.29.1, and 8.0.0 up to (but not including) 8.10.2. It carries a CVSS v3.1 base score of 7.4 (High) (GitHub Advisory, Red Hat CVE).

The vulnerability is classified as CWE-295 (Improper Certificate Validation). When BalancedPool is instantiated, it passes the entire options object through a JSON-based deep clone (JSON.parse(JSON.stringify(...))) before forwarding options to each per-upstream Pool. Since JSON serialization cannot represent functions, any function-valued TLS option — such as a custom checkServerIdentity callback or a custom connector function inside the connect option — is silently discarded. The TLS layer then falls back to Node.js's default hostname and chain validation, which may accept certificates that the application's custom logic was specifically designed to reject. The Client, Pool, Agent, and RoundRobinPool dispatchers are not affected because they destructure connect/tls options prior to cloning. Exploitation requires that the attacker be in a position to present a certificate that passes Node.js's default checks but would have been rejected by the application's custom callback (GitHub Advisory).

Successful exploitation enables a network-based man-in-the-middle attacker to intercept and potentially modify TLS-protected communications between an application using BalancedPool and its upstream servers. Because the custom checkServerIdentity callback is silently dropped, a peer presenting a certificate that passes standard hostname and chain validation — but would otherwise be rejected by application-specific logic — is accepted without warning. This results in high confidentiality and integrity impact, as sensitive data in transit may be exposed or tampered with; availability is not directly affected (GitHub Advisory, Red Hat CVE).

As of the disclosure date (September 4, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is 0.0, and the NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, reflecting the high attack complexity required (the attacker must be positioned as a network man-in-the-middle and the target application must use BalancedPool with a custom function-valued TLS option). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Red Hat CVE).

1. Reconnaissance: Identify target applications that use the undici BalancedPool dispatcher with a custom checkServerIdentity callback or custom connector function in their connect/tls options, and that are running affected versions (7.24.1–7.29.0 or 8.0.0–8.10.1).
2. Network Positioning: Position yourself as a man-in-the-middle on the network path between the vulnerable Node.js application and its upstream TLS server (e.g., via ARP spoofing, DNS hijacking, or rogue Wi-Fi access point).
3. Prepare Rogue Certificate: Obtain or generate a TLS certificate for the target hostname that passes Node.js's default hostname and chain validation (e.g., a certificate signed by a trusted CA for the correct hostname), but which the application's custom checkServerIdentity logic would normally reject (e.g., due to additional pinning or custom attribute checks).
4. Intercept TLS Handshake: Intercept the TLS connection from the vulnerable application and present the rogue certificate. Because the custom checkServerIdentity callback was silently dropped by BalancedPool's JSON clone, the TLS layer only applies Node.js's default validation, which accepts the certificate.
5. Decrypt and Relay Traffic: With the TLS session established to your rogue endpoint, decrypt, inspect, or modify the application's traffic before relaying it to the legitimate upstream server, achieving full man-in-the-middle access (GitHub Advisory).

• Network: Unexpected TLS connections to upstream servers originating from an intermediate host; TLS sessions established with certificates that differ from expected pinned or custom-validated certificates.
• Logs: Node.js application logs showing no TLS validation errors for connections that should have been rejected by custom checkServerIdentity logic; absence of expected certificate rejection log entries.
• Application Behavior: Successful connections to upstream servers using certificates that the application's custom TLS logic was designed to block, without any error or warning being raised by the application.

Upgrade undici to version 7.29.1 (for the 7.x branch) or 8.10.2 (for the 8.x branch), which fix the issue by preserving connect and tls options outside the JSON clone so that custom TLS verification callbacks are forwarded to each upstream unchanged. As an interim workaround, replace BalancedPool with Client, Pool, or Agent dispatchers for any connections that rely on a custom checkServerIdentity or connector function, as these dispatchers are not affected by this vulnerability (GitHub Advisory).

The advisory was published by maintainer mcollina on September 4, 2026, with MegaManSec credited as the reporter and UlisesGascon as the remediation reviewer. No significant broader media coverage or notable community commentary beyond the official advisory has been identified at this time (GitHub Advisory).