CVE-2026-84961

Impact

undici's BalancedPool passes its constructor options through a JSON-based deep clone (JSON.parse(JSON.stringify(...))) before forwarding them to each per-upstream Pool. JSON cannot represent functions, so a caller-supplied connect or tls option containing a checkServerIdentity callback (or a custom connector function) is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reject, but which passes Node's default hostname and chain checks, is silently accepted when the request is made through BalancedPool. Client, Pool, Agent, and RoundRobinPool destructure connect/tls before the clone and are not affected. Only applications that use BalancedPool with a function-valued connect/tls option (such as a custom checkServerIdentity or connector) are affected.

Patches

Upgrade to 7.29.1 or 8.10.2. BalancedPool now preserves the connect and tls options outside the JSON clone, so custom TLS verification callbacks are forwarded to each upstream unchanged.

Workarounds

Use Client, Pool, or Agent instead of BalancedPool for connections that rely on a custom checkServerIdentity or connector, until upgraded.

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

• undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)

• undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)

• undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

Bug Fix(es) and Enhancement(s):

• nodejs24: Rebase to the latest Node.js 24 release [rhel-10] (JIRA:Rocky Linux-249187)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)

• undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)

• undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

Bug Fix(es) and Enhancement(s):

• nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-249189)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)

• undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)

• undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

Bug Fix(es) and Enhancement(s):

• nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8.10.z] (JIRA:Rocky Linux-249188)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer whose certificate the application's custom checkServerIdentity was written to reject, but which still passes Node's default hostname and chain checks, is accepted when reached through BalancedPool. The Client, Pool, and Agent dispatchers are not affected because they extract the connect and tls options before cloning. This affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2, and only when the application supplies a function-valued connect or tls option to BalancedPool. Users should upgrade to undici 7.29.1 or 8.10.2.

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

• undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)
• undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)
• undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

Bug Fix(es) and Enhancement(s):

• nodejs24: Rebase to the latest Node.js 24 release [almalinux-10] (JIRA:AlmaLinux-249187)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)
• undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)
• undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

Bug Fix(es) and Enhancement(s):

• nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-9.8.z] (JIRA:AlmaLinux-249189)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)
• undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)
• undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

Bug Fix(es) and Enhancement(s):

• nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-8.10.z] (JIRA:AlmaLinux-249188)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

TuxCare rebuilt undici to address 7 CVEs. Fixed in 7.29.0-tuxcare.2.

TuxCare rebuilt undici to address 6 CVEs. Fixed in 7.28.0-tuxcare.3.

TuxCare rebuilt undici to address 15 CVEs. Fixed in 7.24.4-tuxcare.2.

TuxCare rebuilt undici-types to address 7 CVEs. Fixed in 7.29.0-tuxcare.2.

These are all security issues fixed in the pi-coding-agent-0.87.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for pi-coding-agent fixes the following issues:

Changes in pi-coding-agent:

• Update to version 1.0.4 (1.0.3 was superseded the same day and never submitted):

  • BREAKING: provider azure-openai-responses renamed to azure, now also serving Azure Foundry Chat Completions (azure/deepseek-v4-pro first). Rename the provider key in auth.json (or run /login again), models.json and settings.json (defaultProvider, enabledModels and modelThinkingLevels); sessions on the old provider fall back and lose prompt cache. AZURE_OPENAI_* env vars unchanged
  • --tools and --exclude-tools take *-patterns and --no-mcp disables MCP for one run; --tools keeps MCP tools unless an entry starts with mcp__
  • Codemode read() on image files yields an image block image() shows, and image() also saves each image to a temp file for later turns
  • Fix fenced-code highlighting past the first line, MCP OAuth native-client registration, MCP shutdown racing a connecting server, Bedrock stalled-stream retries and frozen codemode built-ins, plus ChatGPT-login, EIO-on-closed-terminal and output-file-permission fixes
  • Many more fixes and improvements; see upstream's release notes for the full list

• Refresh the vendored node_modules 1.0.2 -> 1.0.4: the ten @earendil-works packages move to 1.0.4; nanoid, postcss and vite move too but are dev-only and not shipped. Still 119 shipped modules and the licence union is unchanged

  • CVE-2026-102276 (boo#1283188): brace-expansion is 5.0.12, above the 5.0.10 fix floor, so the package is not affected by it
  • CVE-2026-102277 (boo#1283392) and CVE-2026-102278 (boo#1283412): brace-expansion is 5.0.12, at the 5.0.12 and above the 5.0.11 fix floors, so the package is not affected by them

• Update to version 1.0.2: patch releases on the 1.0 API, with no breaking changes

  • models.json takes samplingParamsByThinkingLevel next to the existing samplingParams, so an OpenAI-compatible model can set temperature, top_p and the like separately for off, minimal, low, medium, high, xhigh and max. Model defaults, the effective level's override and the request are merged per key, modelOverrides merges per level, and the levels are pi's own, not the provider's thinkingLevelMap values. Only openai-completions, openai-responses and azure-openai-responses apply them
  • MCP servers can be enabled, disabled or re-scoped per project from a .pi/mcp.json entry without a command or url, and /mcp toggles a user-level server for the current project
  • oauth.clientRegistration: "cimd" identifies pi by its Client ID Metadata Document instead of dynamic client registration
  • pi.registerToolRenderer() picks how calls to a tool that is not registered yet are drawn, such as MCP tools in a resumed session
  • Cloudflare's Clef and Clef Flash classifier models are usable from codemode scripts and extensions
  • A codemode script printing in a loop now fails at 16 Mi characters or 100000 items instead of running pi out of memory
  • MCP tool calls in resumed sessions and HTML exports no longer render fully expanded until their server connects
  • JPEG, GIF and WebP images that extensions draw through Image now appear in Kitty, Ghostty, WezTerm and Warp, and fullscreen Kitty images no longer collapse to a one-row strip after scrolling in WezTerm
  • Many more fixes and improvements; see upstream's release notes for the full list

• Refresh the vendored node_modules over 1.0.0 -> 1.0.2: the ten @earendil-works packages move to 1.0.2, with pi-telemetry the one that was already at 1.0.2 in the 1.0.1 tree, plus @anthropic-ai/sdk to 0.129.0. No module leaves or joins the 119 shipped ones and the licence union is unchanged

  • CVE-2026-102276 (boo#1283188): brace-expansion is 5.0.12, above the 5.0.10 fix floor, so the package is not affected by it. Upstream's 1.0.1 made…

Root has patched CVE-2026-84961 in the undici package for Root:npm. Multiple fixed versions available.