Description

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer whose certificate the application's custom checkServerIdentity was written to reject, but which still passes Node's default hostname and chain checks, is accepted when reached through BalancedPool. The Client, Pool, and Agent dispatchers are not affected because they extract the connect and tls options before cloning. This affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2, and only when the application supplies a function-valued connect or tls option to BalancedPool. Users should upgrade to undici 7.29.1 or 8.10.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-09-04T17:17:02.227Z",
  "pubdate": "2026-09-04T17:17:02.227Z",
  "executiveSummary": "A critical security vulnerability exists in the BalancedPool component of the undici library, involving improper serialization of TLS configuration options. The vulnerability stems from an insecure deep-clone implementation that utilizes JSON serialization and parsing, which inherently strips function-valued properties from the options object.\nThis flaw prevents custom TLS verification logic, such as the checkServerIdentity callback or custom connector functions, from being passed to the underlying TLS layer. Consequently, connections intended to be restricted by custom validation may proceed if they pass standard default hostname and chain checks, even if they would otherwise be rejected by the application's security policy.\nThe vulnerability impacts undici versions 7.24.1 through 7.29.1 and 8.0.0 through 8.10.2. The risk is high in environments relying on custom certificate pinning or identity verification to mitigate man-in-the-middle (MITM) attacks. An attacker could potentially intercept or spoof traffic that the application explicitly intended to block via custom validation logic. Exploitation does not require prior authentication, provided the application utilizes the affected BalancedPool constructor with custom function-based TLS options.",
  "technicalDetails": "The root cause of this vulnerability is the use of JSON.stringify and JSON.parse for deep-cloning the options object within the BalancedPool constructor. Because the JSON specification does not support function objects, any properties containing functions—specifically those essential for configuring custom TLS behavior—are silently omitted during the serialization process.\nIn the context of undici, TLS options such as 'checkServerIdentity' or custom 'connect' overrides are frequently passed as function references to implement specialized security checks. While other dispatchers like Client, Pool, and Agent correctly sanitize and extract these parameters before cloning, the BalancedPool implementation erroneously performs the clone on the entire options object prior to configuration. This results in the loss of critical security callbacks before they are registered with Node.js's native TLS module.\nThe attack flow proceeds as follows: 1) An application developer configures a BalancedPool with a custom 'checkServerIdentity' function designed to perform strict certificate validation or revocation checks beyond standard hostname verification. 2) The BalancedPool constructor invokes the flawed deep-clone mechanism, effectively removing the 'checkServerIdentity' property. 3) The connection proceeds to the TLS layer using only default, non-customized validation logic. 4) A malicious peer, which presents a certificate that passes basic Node.js chain validation but fails the omitted application-specific requirements, is successfully connected. 5) The application processes data over an insecure or untrusted connection, potentially exposing sensitive information or allowing for malicious command injection.\nThe vulnerability is restricted to the BalancedPool component and specifically manifests only when the application provides function-valued TLS or connect parameters. Other undici dispatchers are unaffected as they do not employ this flawed cloning sequence. The exposure is network-based, as the exploitation depends on the attacker's ability to present a certificate that evades standard validation while specifically triggering the omitted security check. There are no authentication or privilege requirements to trigger the behavior, as the failure occurs during the pool initialization and subsequent connection phase."
}