Bug 2528735 (CVE-2026-84961)

Summary:	CVE-2026-84961 undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	abarbaro, akhatavk, alizardo, aos-team-art-private, asdas, ataylor, cdrage, csuconic, dbruscin, dpaolell, dschmidt, eborisov, ehugonne, gbenhaim, gtanzill, gtully, jbuscemi, jchui, jdelft, jhe, jlanda, jsherman, jupierce, kshier, ktsao, kvanderr, lball, lchilton, lgarciaa, mbiarnes, mstipich, nboldt, ngough, niyer, oaljalju, ppalepu, ppostler, prdhamdh, psrna, rexwhite, rgemmell, rgodfrey, rhel-process-autobot, rushinde, sdawley, sfeifer, sghai, sidsharm, simaishi, stcannon, sthirugn, suppawar, tbish, teagle, tlavocat, twaugh, veshanka, vlaad, watson-tool-maintainers, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in undici's BalancedPool component. This vulnerability allows a remote attacker to bypass Transport Layer Security (TLS) certificate validation. The BalancedPool constructor incorrectly processes its options, silently discarding custom certificate validation functions. Consequently, a peer with an otherwise untrusted certificate may be accepted, potentially compromising the integrity of secure communication.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2531869
Bug Blocks:

Description OSIDB Bzimport 2026-09-04 17:16:49 UTC

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer whose certificate the application's custom checkServerIdentity was written to reject, but which still passes Node's default hostname and chain checks, is accepted when reached through BalancedPool. The Client, Pool, and Agent dispatchers are not affected because they extract the connect and tls options before cloning. This affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2, and only when the application supplies a function-valued connect or tls option to BalancedPool. Users should upgrade to undici 7.29.1 or 8.10.2.

Comment 2 Jon Orris 2026-09-29 16:29:43 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:73428 https://access.redhat.com/errata/RHSA-2026:73428

Comment 3 Jon Orris 2026-09-30 10:57:52 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:73838 https://access.redhat.com/errata/RHSA-2026:73838