{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "undici: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/undici--undici/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/undici--undici/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-87018/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-87018/",
   "title": "CVE-2026-87018 · undici · disclosed",
   "content_text": "undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it.",
   "date_published": "2026-10-15T18:38:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-87018/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-87018/",
   "title": "CVE-2026-87018 · undici · fixed in Red Hat hummingbird 1 (nodejs24 0:24.21.0-1.5.hum1 and 17 more)",
   "content_text": "Fixed versions: nodejs24 0:24.21.0-1.5.hum1, nodejs24-bin 0:24.21.0-1.5.hum1, nodejs24-devel 0:24.21.0-1.5.hum1, nodejs24-docs 0:24.21.0-1.5.hum1, nodejs24-full-i18n 0:24.21.0-1.5.hum1, nodejs24-libs 0:24.21.0-1.5.hum1, nodejs24-npm 0:11.19.0-1.24.21.0.1.5.hum1, nodejs24-npm-bin 0:24.21.0-1.5.hum1, nodejs26 0:26.11.1-0.4.hum1, nodejs26-bin 0:26.11.1-0.4.hum1, nodejs26-devel 0:26.11.1-0.4.hum1, nodejs26-docs 0:26.11.1-0.4.hum1, nodejs26-full-i18n 0:26.11.1-0.4.hum1, nodejs26-libs 0:26.11.1-0.4.hum1, nodejs26-npm 0:11.20.0-1.26.11.1.0.4.hum1, nodejs26-npm-bin 0:26.11.1-0.4.hum1, v8-13.6-devel 0:13.6.233.17-1.24.21.0.1.5.hum1, v8-14.6-devel 0:14.6.202.34-1.26.11.1.0.4.hum1.",
   "date_published": "2026-10-15T18:38:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-109383/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-109383/",
   "title": "CVE-2026-109383 · undici · disclosed",
   "content_text": "undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent functions, a caller-supplied tls option containing a checkServerIdentity callback is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reject, but which passes Node's default hostname and chain checks, is silently accepted. Because Agent is the default dispatcher behind request, fetch, and setGlobalDispatcher, this affects the path most applications use, and EnvHttpProxyAgent is affected on its direct and no-proxy routes as well, while only applications that pass a function-valued tls option such as a custom checkServerIdentity for certificate or public-key pinning are at risk. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which preserve the tls option outside the JSON clone so custom verification callbacks are forwarded unchanged, and users should upgrade to one of those versions or later. As a workaround, pass the TLS options through connect instead of tls, or for proxied destinations use requestTls and proxyTls.",
   "date_published": "2026-10-15T18:34:01Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-109383/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-109383/",
   "title": "CVE-2026-109383 · undici · fixed in Red Hat hummingbird 1 (nodejs24 0:24.21.0-1.5.hum1 and 17 more)",
   "content_text": "Fixed versions: nodejs24 0:24.21.0-1.5.hum1, nodejs24-bin 0:24.21.0-1.5.hum1, nodejs24-devel 0:24.21.0-1.5.hum1, nodejs24-docs 0:24.21.0-1.5.hum1, nodejs24-full-i18n 0:24.21.0-1.5.hum1, nodejs24-libs 0:24.21.0-1.5.hum1, nodejs24-npm 0:11.19.0-1.24.21.0.1.5.hum1, nodejs24-npm-bin 0:24.21.0-1.5.hum1, nodejs26 0:26.11.1-0.4.hum1, nodejs26-bin 0:26.11.1-0.4.hum1, nodejs26-devel 0:26.11.1-0.4.hum1, nodejs26-docs 0:26.11.1-0.4.hum1, nodejs26-full-i18n 0:26.11.1-0.4.hum1, nodejs26-libs 0:26.11.1-0.4.hum1, nodejs26-npm 0:11.20.0-1.26.11.1.0.4.hum1, nodejs26-npm-bin 0:26.11.1-0.4.hum1, v8-13.6-devel 0:13.6.233.17-1.24.21.0.1.5.hum1, v8-14.6-devel 0:14.6.202.34-1.26.11.1.0.4.hum1.",
   "date_published": "2026-10-15T18:34:01Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-109829/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-109829/",
   "title": "CVE-2026-109829 · undici · disclosed",
   "content_text": "undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handler changes the origin, so a response produced after a cross-origin redirect is stored under the original key. An attacker who controls the target of a redirect from a trusted URL can have their response cached under that trusted URL and served to later callers, allowing persistent cache poisoning, and the same key confusion lets a private, non-stored redirect response to a user-specific resource be stored under the original URL and served to a later unauthenticated caller, disclosing private data. Applications are affected only when an originless Agent, a shared cache store, and the redirect-then-cache composition are all used. The issue is fixed in undici 7.30.1 and 8.12.2, which verify the producing origin still matches the cache key and preserve each redirect hop's cache-control policy before storing, and users should upgrade to one of those versions or later. As a workaround, compose the cache interceptor before the redirect interceptor, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.",
   "date_published": "2026-10-15T18:28:04Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-109829/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-109829/",
   "title": "CVE-2026-109829 · undici · fixed in Red Hat hummingbird 1 (nodejs24 0:24.21.0-1.5.hum1 and 17 more)",
   "content_text": "Fixed versions: nodejs24 0:24.21.0-1.5.hum1, nodejs24-bin 0:24.21.0-1.5.hum1, nodejs24-devel 0:24.21.0-1.5.hum1, nodejs24-docs 0:24.21.0-1.5.hum1, nodejs24-full-i18n 0:24.21.0-1.5.hum1, nodejs24-libs 0:24.21.0-1.5.hum1, nodejs24-npm 0:11.19.0-1.24.21.0.1.5.hum1, nodejs24-npm-bin 0:24.21.0-1.5.hum1, nodejs26 0:26.11.1-0.4.hum1, nodejs26-bin 0:26.11.1-0.4.hum1, nodejs26-devel 0:26.11.1-0.4.hum1, nodejs26-docs 0:26.11.1-0.4.hum1, nodejs26-full-i18n 0:26.11.1-0.4.hum1, nodejs26-libs 0:26.11.1-0.4.hum1, nodejs26-npm 0:11.20.0-1.26.11.1.0.4.hum1, nodejs26-npm-bin 0:26.11.1-0.4.hum1, v8-13.6-devel 0:13.6.233.17-1.24.21.0.1.5.hum1, v8-14.6-devel 0:14.6.202.34-1.26.11.1.0.4.hum1.",
   "date_published": "2026-10-15T18:28:04Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-109869/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-109869/",
   "title": "CVE-2026-109869 · undici · disclosed",
   "content_text": "undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses because of a content-encoding limit, but it created the internal response stream before that check and returned without attaching an error listener or aborting the request, so the early close surfaces a content-length mismatch on the orphaned stream, which Node.js treats as an unhandled error and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the fetch() rejection, resulting in a denial of service. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. There is no workaround.",
   "date_published": "2026-10-15T18:08:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-109869/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-109869/",
   "title": "CVE-2026-109869 · undici · fixed in Chainguard (pelias-api 7.11.0-r3)",
   "content_text": "Fixed versions: pelias-api 7.11.0-r3.",
   "date_published": "2026-10-15T18:08:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-109869/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-109869/",
   "title": "CVE-2026-109869 · undici · fixed upstream (npm)",
   "content_text": "Fixed versions: undici 6.29.1, undici 7.30.1, undici 8.12.2.",
   "date_published": "2026-10-15T18:08:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-109869/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-109869/",
   "title": "CVE-2026-109869 · undici · fixed in Red Hat hummingbird 1 (nodejs24 0:24.21.0-1.5.hum1 and 17 more)",
   "content_text": "Fixed versions: nodejs24 0:24.21.0-1.5.hum1, nodejs24-bin 0:24.21.0-1.5.hum1, nodejs24-devel 0:24.21.0-1.5.hum1, nodejs24-docs 0:24.21.0-1.5.hum1, nodejs24-full-i18n 0:24.21.0-1.5.hum1, nodejs24-libs 0:24.21.0-1.5.hum1, nodejs24-npm 0:11.19.0-1.24.21.0.1.5.hum1, nodejs24-npm-bin 0:24.21.0-1.5.hum1, nodejs26 0:26.11.1-0.4.hum1, nodejs26-bin 0:26.11.1-0.4.hum1, nodejs26-devel 0:26.11.1-0.4.hum1, nodejs26-docs 0:26.11.1-0.4.hum1, nodejs26-full-i18n 0:26.11.1-0.4.hum1, nodejs26-libs 0:26.11.1-0.4.hum1, nodejs26-npm 0:11.20.0-1.26.11.1.0.4.hum1, nodejs26-npm-bin 0:26.11.1-0.4.hum1, v8-13.6-devel 0:13.6.233.17-1.24.21.0.1.5.hum1, v8-14.6-devel 0:14.6.202.34-1.26.11.1.0.4.hum1.",
   "date_published": "2026-10-15T18:08:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-109855/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-109855/",
   "title": "CVE-2026-109855 · undici · disclosed",
   "content_text": "undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server then destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits. A remote, unauthenticated server can therefore crash any client that opens a WebSocket to it over HTTP/2, resulting in a denial of service. The issue is fixed in undici 8.11.2, and users should upgrade to 8.11.2 or later. As a workaround, set allowH2 to false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers.",
   "date_published": "2026-10-15T08:12:51Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-109855/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-109855/",
   "title": "CVE-2026-109855 · undici · fixed in Red Hat hummingbird 1 (grafana12.4 0:12.4.12-0.4.hum1 and 8 more)",
   "content_text": "Fixed versions: grafana12.4 0:12.4.12-0.4.hum1, nodejs26 0:26.11.1-0.3.hum1, nodejs26-bin 0:26.11.1-0.3.hum1, nodejs26-devel 0:26.11.1-0.3.hum1, nodejs26-docs 0:26.11.1-0.3.hum1, nodejs26-full-i18n 0:26.11.1-0.3.hum1, nodejs26-libs 0:26.11.1-0.3.hum1, nodejs26-npm 0:11.20.0-1.26.11.1.0.3.hum1, nodejs26-npm-bin 0:26.11.1-0.3.hum1.",
   "date_published": "2026-10-15T08:12:51Z"
  }
 ]
}