undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation
Summary
| CVE | CVE-2026-87018 |
|---|---|
| State | PUBLISHED |
| Assigner | openjs |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-15 19:17:46 UTC |
| Updated | 2026-10-16 20:18:12 UTC |
| Description | undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it. |
Risk And Classification
Primary CVSS: v3.1 7.5 HIGH from ce714d77-add3-4f53-aff5-83d477b104bb
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Problem Types: CWE-248 | CWE-617 | CWE-248 CWE-248: Uncaught Exception | CWE-617 CWE-617: Reachable Assertion
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ce714d77-add3-4f53-aff5-83d477b104bb | Secondary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | CNA | CVSS | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Undici | Undici | affected 4.2.1 6.29.1 semver | Not specified |
| CNA | Undici | Undici | unaffected 6.29.1 semver | Not specified |
| CNA | Undici | Undici | affected 7.0.0 7.30.1 semver | Not specified |
| CNA | Undici | Undici | unaffected 7.30.1 semver | Not specified |
| CNA | Undici | Undici | affected 8.0.0 8.12.2 semver | Not specified |
| CNA | Undici | Undici | unaffected 8.12.2 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| cna.openjsf.org/security-advisories.html | ce714d77-add3-4f53-aff5-83d477b104bb | cna.openjsf.org | |
| github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm | ce714d77-add3-4f53-aff5-83d477b104bb | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: benzdeus (en)
CNA: mcollina (en)
CNA: UlisesGascon (en)
There are currently no legacy QID mappings associated with this CVE.