CVE-2026-84961 Nodejs CVE debrief

Who should care

Defenders and developers using undici's BalancedPool with custom TLS options should assess exposure and prioritize verification and remediation. This includes reviewing undici versions between 7.24.1 and 7.29.1 or 8.0.0 and 8.10.2, verifying if custom TLS options are used with BalancedPool, and upgrading to undici 7.29.1 or 8.10.2 if vulnerable.

Why it matters

CVE-2026-84961 is a high-severity vulnerability in undici's BalancedPool constructor that discards custom TLS options, potentially allowing unintended acceptance of peers. Defenders and developers using undici should assess exposure, verify versions, and prioritize remediation.

• Potential for unintended acceptance of peers whose certificates would be rejected by custom checkServerIdentity callbacks
• Possible bypass of hostname and chain checks due to discarded custom connector or TLS options
• Need for verification of undici versions and custom TLS option usage
• Priority on upgrading to fixed versions or adjusting TLS configurations

Technical summary

The undici library's BalancedPool constructor has a vulnerability where it discards function-valued TLS options, such as custom checkServerIdentity callbacks or connectors, due to internal deep-cloning that serializes and reparses the value as JSON. This affects versions from 7.24.1 to 7.29.1 and 8.0.0 to 8.10.2 when using a custom TLS option with BalancedPool. The vulnerability has a high severity score of 7.4 and can lead to unintended acceptance of peers whose certificates would be rejected by custom checkServerIdentity callbacks.

Defensive priority

Defenders should assess exposure and prioritize verification of undici versions between 7.24.1 and 7.29.1 or 8.0.0 and 8.10.2, especially when using custom TLS options with BalancedPool.

Recommended defensive actions

• Assess exposure of undici versions between 7.24.1 and 7.29.1 or 8.0.0 and 8.10.2
• Verify if custom TLS options are used with BalancedPool
• Upgrade to undici 7.29.1 or 8.10.2 if vulnerable
• Review and update TLS configurations for BalancedPool
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in undici's BalancedPool constructor, which discards function-valued TLS options. Official sources include the CVE Program record, NVD vulnerability detail, and references from OpenJSF and Nodejs.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.