CVE-2026-109383: undici Agent Silently Drops TLS checkServerIdentity Callback

CVE-2026-109383 is a TLS certificate-validation bypass in undici, the HTTP client library that underlies Node.js's built-in fetch and request APIs, where the Agent dispatcher's internal JSON-based cloning of its own configuration silently strips out a caller's custom checkServerIdentity callback, so certificate or public-key pinning logic an application thinks is enforced never actually runs — a TLS peer the app meant to reject is instead accepted.

CVE-2026-109383 (CWE-295, Improper Certificate Validation) affects undici, the HTTP client library that ships with and powers Node.js's built-in fetch, request, and setGlobalDispatcher APIs. NVD's description states: "undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent functions, a caller-supplied tls option containing a checkServerIdentity callback is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reject, but which passes Node's default hostname and chain checks, is silently accepted" (NVD). Because Agent is the default dispatcher behind request, fetch, and setGlobalDispatcher, this affects the path most applications use; EnvHttpProxyAgent is also affected on its direct and NO_PROXY routes, which delegate to an internal Agent. Only applications that pass a function-valued tls option — such as a custom checkServerIdentity for certificate or public-key pinning — are at risk; passing the same options through connect instead is unaffected.

NVD's own analysis assigns a Primary CVSS v3.1 base score of 9.1 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H — network-reachable, low complexity, no privileges or user interaction required. The CNA's own submission (GitHub Security Advisories, via OpenJS Foundation) scores it materially lower, CVSS v3.1 7.4 (high), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N — the vendor treats attack complexity as High rather than Low, reflecting that an attacker also needs to be positioned as a TLS peer whose certificate would otherwise fail the custom check (GitHub Advisory Database GHSA-2m5v-pch6-74hx).

The GitHub Security Advisory, published by the undici maintainers on 2026-10-27, confirms the mechanism and notes this is "the Agent counterpart of the BalancedPool certificate validation bypass fixed in CVE-2026-84961" — i.e. a sibling bug in a related dispatcher class. The advisory lists three patched releases — [email protected], 7.30.1, and 8.12.2 — stating that Agent "now preserves the tls option outside the JSON clone, so custom TLS verification callbacks are forwarded to each origin unchanged," and documents three fix commits to the undici repository. As a workaround short of upgrading, the advisory recommends passing TLS options through connect instead of tls, or for proxied destinations using requestTls/proxyTls (GitHub Advisory Database GHSA-2m5v-pch6-74hx).

As of 2026-10-30, FIRST scores the probability of exploitation at 0.00184 (8.0th percentile) — low, consistent with a bug that only matters to the subset of applications doing custom certificate pinning rather than relying on default TLS validation (FIRST EPSS). CVE-2026-109383 is not currently listed in the CISA Known Exploited Vulnerabilities catalog (checked against the live KEV feed, catalog version 2026.10.30, 1766 entries).

Applications that construct an undici Agent (directly, via Node's global fetch/request, or via EnvHttpProxyAgent) and pass a function-valued tls.checkServerIdentity for certificate or public-key pinning should upgrade to undici 6.29.1, 7.30.1, or 8.12.2; applications that rely solely on default Node TLS hostname/chain validation are not affected by this particular bug.

• undici's Agent dispatcher JSON-clones its constructor options before forwarding them to each per-origin pool, silently dropping a caller-supplied tls.checkServerIdentity callback (a function, which JSON cannot represent) so a certificate the callback would reject is instead accepted via default checks. — NVD
• NVD Primary CVSS v3.1 base score is 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H); the CNA's own GitHub Security Advisory submission scores it 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), treating attack complexity as High rather than Low. — GitHub Advisory Database
• GHSA-2m5v-pch6-74hx, published 2026-10-27, confirms the fix in undici 6.29.1, 7.30.1, and 8.12.2 (which preserve the tls option outside the JSON clone), lists three fix commits, and documents a workaround of passing TLS options through connect or requestTls/proxyTls instead of tls. — GitHub Advisory Database
• EPSS score is 0.00184 (8.0th percentile) as of 2026-10-30; not present in the live CISA KEV feed (catalog version 2026.10.30, 1766 entries) checked by exact cveID match. — FIRST EPSS