CVE-2026-84961

Executive Summary

CVE-2026-84961 is a TLS certificate validation bypass in the Node.js undici HTTP client library, specifically affecting the BalancedPool dispatcher. The constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON, and because JSON cannot represent functions, any function-valued TLS option (such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option) is silently discarded before it reaches the TLS layer. Applications that rely on a custom checkServerIdentity to reject specific peers may therefore accept a peer's certificate that still passes Node's default hostname and chain checks. The vulnerability affects undici 7.24.1 through 7.29.0 and 8.0.0 through 8.10.1, and is rated CVSS 7.4 (High). Exploitation requires a network-position adversary capable of presenting a certificate that passes Node's default checks but would have been rejected by the application's custom callback, resulting in confidentiality and integrity impact.

Technical Analysis

The core defect is a mismatch between the caller's security intent and the actual TLS configuration applied by BalancedPool. When an application constructs a BalancedPool, it may supply an options object containing function-valued TLS settings — most notably a checkServerIdentity callback or a connector nested inside the connect option. These are legitimate, security-relevant hooks: checkServerIdentity is the Node.js TLS API invoked after the default chain and hostname validation, allowing the application to impose additional peer-identity constraints.

The BalancedPool constructor forwards its entire options object through an internal deep-clone routine that serializes the value to JSON and reparses it. JSON has no representation for functions, so any function-valued property is dropped during this round-trip. The sanitized options object — now lacking the checkServerIdentity callback and any function-valued connector — is then used to configure the underlying TLS connections. The TLS layer consequently falls back to Node's default validation behavior: chain-of-trust and hostname verification only.

The critical scope note from the description is that Client, Pool, and Agent dispatchers are not affected, because they extract the connect and tls options before cloning. This asymmetry confirms the bug is localized to BalancedPool's constructor path and to the specific moment of deep-cloning. The vulnerability class is CWE-295 (Improper Certificate Validation). It is a "fail-open" defect: the security control is silently removed rather than producing an error, so the application has no runtime signal that its custom validation is no longer in effect. The affected version windows are 7.24.1–7.29.0 and 8.0.0–8.10.1; fixed releases are 7.29.1 and 8.10.2. The CVSS vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N reflects a network-reachable, high-complexity attack (AC:H, because the adversary must possess a certificate that satisfies Node's defaults yet fails the application's custom check) with no privileges or user interaction required, and high confidentiality and integrity impact within the vulnerable component.

Exploitation Scenarios

No public exploit code or Nuclei template is available; the attack chain below is inferred from the vulnerability class and the data provided.

1. Reconnaissance / target identification. The adversary identifies a Node.js service that uses undici's BalancedPool dispatcher and that is known (or presumed) to supply a function-valued checkServerIdentity or a custom connector in its connect/tls options. This is typically an internal service-to-service client or a gateway that deliberately pins or constrains peer identity beyond the default hostname/chain checks. Version fingerprinting targets undici in the 7.24.1–7.29.0 or 8.0.0–8.10.1 windows.

2. Triggering the flaw class. The adversary arranges to be the peer reached through BalancedPool. Because the deep-clone strips the application's function-valued TLS options, the connection is validated using only Node's default chain and hostname checks. The adversary therefore needs a certificate that passes those defaults — for example, a certificate issued for the expected hostname by any chain trusted by the client's trust store — but that the application's own callback was written to reject (for instance, a specific issuer, subject, or key the callback blacklists).

3. Payload / execution method. At the vulnerability-class level: the attacker completes a TLS handshake that the application intended to forbid. The discarded checkServerIdentity callback never executes, and any custom connector behavior is bypassed. The adversary then serves responses over that attacker-controlled or unauthorized endpoint while the client believes it is talking to a validated peer.

4. Post-exploitation impact. With the peer-identity restriction removed, the adversary can impersonate the expected upstream and return crafted responses to the BalancedPool client. This enables manipulation of data the application consumes (integrity) and exposure of data the application transmits to the endpoint (confidentiality), consistent with the CVSS C:H/I:H subscores. No public evidence of in-the-wild exploitation exists; EPSS is 0.00146 (4.3rd percentile) and the CVE is not in CISA KEV.

Impact Assessment

Business impact centers on trust-boundary erosion in Node.js services that use BalancedPool with custom TLS validation. Affected systems are those running undici in the vulnerable version windows and supplying a function-valued connect or tls option to BalancedPool; per the OSV data both listed package ranges remain marked unfixed in the feed snapshot, indicating remediation depends on applying the 7.29.1 / 8.10.2 releases. The blast radius is bounded by the AC:H metric: exploitation requires a certificate that satisfies Node defaults but fails the custom check, plus a network position to be reached as the peer. Where those conditions hold, impact is High for confidentiality and integrity (C:H/I:H) and None for availability (A:N), scope unchanged (S:U). The silent nature of the failure — no exception, no log entry from the missing callback — means affected deployments may not know their custom validation is inert. Given a High CVSS (7.4) with no KEV listing and a low EPSS, risk is best treated as a configuration-integrity defect requiring version-based remediation rather than emergency incident response.

Detection Guidance

Detection strategies focus on (a) inventorying undici versions and BalancedPool usage, (b) asserting that custom TLS callbacks are actually in effect, and (c) monitoring TLS session metadata. Because the bug removes a validation function rather than emitting an error, network detection is inherently weak; the rules below are best-effort heuristics and version/config correlations.

Sigma Rule

title: Potential undici BalancedPool TLS Validation Bypass (CVE-2026-84961)
id: 8f1c2a94-3b7e-4d21-9c0a-6e5f7a1b2c3d
status: experimental
description: Detects Node.js processes loading vulnerable undici versions that may be affected by CVE-2026-84961 (BalancedPool drops function-valued TLS options).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84961
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - '/node'
      - '/nodejs'
  selection_cmd:
    CommandLine|contains:
      - 'BalancedPool'
      - 'undici'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate Node.js applications using undici without custom TLS options
level: low
tags:
  - attack.t1190
  - cve.2026.84961

YARA Rule

rule CVE_2026_84961_undici_BalancedPool
{
    meta:
        description = "Detects undici BalancedPool option-cloning logic associated with CVE-2026-84961"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84961"
        date = "2026-01-01"
        severity = "high"
    strings:
        $s1 = "BalancedPool" ascii wide
        $s2 = "checkServerIdentity" ascii wide
        $s3 = "JSON.parse(JSON.stringify" ascii wide
        $s4 = "connector" ascii wide
    condition:
        $s1 and 2 of ($s2, $s3, $s4)
}

Suricata IDS Rule

alert tls any any -> any any (msg:"CVE-2026-84961 Possible undici BalancedPool TLS Validation Bypass - ClientHello to non-default peer"; flow:to_server; tls.handshake.type:1; threshold:type limit, track by_src, count 1, seconds 60; classtype:policy-violation; reference:cve,2026-84961; sid:8496101; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5s
  [process where event.type == "start" and process.name in ("node", "nodejs")]
  [network where event.type == "start" and network.transport == "tcp" and network.direction == "outbound"]

Splunk SPL Query

index=os sourcetype=process_creation (Image=*node* OR Image=*nodejs*)
| search CommandLine="*BalancedPool*" OR CommandLine="*undici*"
| stats count by host, user, CommandLine
| where count >= 1

Wazuh OSSEC Rule

<group name="cve_2026_84961,nodejs,undici,">
  <rule id="849610" level="6">
    <decoded_as>json</decoded_as>
    <match>BalancedPool</match>
    <description>CVE-2026-84961: Node.js undici BalancedPool usage detected - verify TLS validation callbacks are effective.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>tls_validation_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 4/4 (CONFIRMED — NVD, OSV, and RHSA independently confirm the fix).

1. Immediate mitigations. Identify all code paths that construct undici's BalancedPool with a function-valued connect or tls option (notably a custom checkServerIdentity or a custom connector). Because the flaw silently discards these, do not rely on them while running a vulnerable version; enforce peer-identity restrictions at the infrastructure layer (mutual TLS enforced by a proxy, network ACLs, or certificate pinning outside the library) until an upgrade is applied. Where feasible, switch the affected client code to Client, Pool, or Agent, which extract the connect and tls options before cloning and are not affected.

2. Patch / upgrade steps. Upgrade undici to 7.29.1 or 8.10.2. Verify the resolved version after upgrade (dependency lockfiles, npm ls undici, or equivalent) and confirm no transitive dependency reintroduces a vulnerable range. Note the OSV feed snapshot still lists the tracked package ranges as unfixed; validate against the fixed release rather than feed status.

3. Long-term hardening. Add automated dependency-version gating to CI so vulnerable undici windows are blocked at build time. Add regression tests that assert a supplied checkServerIdentity callback is actually invoked for BalancedPool connections, so future regressions in option handling fail loudly rather than silently. Treat "security control silently removed" defects as a first-class test category, and monitor the undici advisory stream for follow-on issues in the option-handling code paths.

References

• NVD — https://nvd.nist.gov/vuln/detail/CVE-2026-84961
• OSV — package advisory for undici (ranges 7.24.1–7.29.0 and 8.0.0–8.10.1)
• RHSA — Red Hat security advisory referencing the undici fix
• undici project releases — 7.29.1 and 8.10.2 (fixed versions)
• CISA KEV — not listed (no known in-the-wild exploitation as of this report)

Note: No public PoC or exploit code was identified (PoC status: Public per advisory data, but no Nuclei template and no exploit code available). No threat-actor campaigns tied to CVE-2026-84961 are documented at this time.