CVE-2026-87018 undici CVE debrief

Who should care

Defenders responsible for Node.js applications using the undici library should assess exposure and prioritize updates to fixed versions. Defenders should care about this vulnerability because it can cause a Denial of Service in Node.js applications using the undici library. The vulnerability can be exploited by a malicious HTTPS endpoint with a single server-initiated renegotiation, potentially impacting in-flight requests and background work. Node.js re-r

Why it matters

Defenders should care about this vulnerability because it can cause a Denial of Service in Node.js applications using the undici library. The vulnerability can be exploited by a malicious HTTPS endpoint with a single server-initiated renegotiation, potentially impacting in-flight requests and background work.

• Potential Denial of Service attacks
• Crash of client process with a single server-initiated renegotiation
• Impact on in-flight requests and background work

Technical summary

The undici HTTP client library for Node.js is vulnerable to a Denial of Service attack via TLS 1.2 certificate-changing renegotiation. This occurs when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. The vulnerability is caused by undici's improper handling of TLS 1.2 certificate-changing renegotiation. When a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host, the client process crashes.

Defensive priority

Defenders should prioritize updating to fixed versions of undici (6.29.1, 7.30.1, or 8.12.2) to prevent potential Denial of Service attacks.

Recommended defensive actions

• Update to undici version 6.29.1, 7.30.1, or 8.12.2
• Review and update affected systems and applications
• Monitor for potential Denial of Service attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by undici's improper handling of TLS 1.2 certificate-changing renegotiation. When a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host, the client process crashes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.