{"id":"ghsa-ghsa-2m5v-pch6-74hx","seq":1708761,"kind":"advisory","title":"undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent","url":"https://github.com/advisories/GHSA-2m5v-pch6-74hx","permalink":"https://vulnpulse.app/items/ghsa-ghsa-2m5v-pch6-74hx","summary":"影響: npm:undici >= 4.0.0, < 6.29.1 → 6.29.1, npm:undici >= 7.0.0, < 7.30.1 → 7.30.1, npm:undici >= 8.0.0, < 8.12.2 → 8.12.2\nundici's Agent passes its constructor options through a JSON-based deep clone (JSON.parse(JSON.stringify(...))) before forwarding them to each per-origin Pool. JSON cannot represent functions, so a caller-supplied tls option containing a checkServerIdentity callback is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reject, but which passes Node's default hostname and chain checks, is silently accepted when…","severity":"high","techs":["nodejs"],"cves":["CVE-2026-109383"],"tags":["GHSA-2m5v-pch6-74hx","undici","undici","undici"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T19:02:26.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}