Zafiyetler / CVE-2026-84961

kritik

CVE-2026-84961

undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options

Yayın Değişiklik CWE 295
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.

Kaynağa göre önem derecesi

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GHSA7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: GHSA (yüksek), Red Hat (yüksek), AlmaLinux (yüksek), Amazon (yüksek), Oracle (yüksek), Rocky Linux (yüksek).

Açıklama

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer whose certificate the application's custom checkServerIdentity was written to reject, but which still passes Node's default hostname and chain checks, is accepted when reached through BalancedPool. The Client, Pool, and Agent dispatchers are not affected because they extract the connect and tls options before cloning. This affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2, and only when the application supplies a function-valued connect or tls option to BalancedPool. Users should upgrade to undici 7.29.1 or 8.10.2.

Etkilenen paketler ve düzeltilmiş sürümler

KaynakPaketDüzeltildiği sürüm
alma 10nodejs24, nodejs24-devel, nodejs24-docs ve 3 tane daha1:24.21.0-1.el10_2 ve 1 tane daha
alma 8nodejs:24::nodejs, nodejs:24::nodejs-devel, nodejs:24::nodejs-docs ve 7 tane daha1:24.21.0-1.module_el8.10.0+4292+21afb960 ve 4 tane daha
alma 9nodejs:24::nodejs, nodejs:24::nodejs-devel, nodejs:24::nodejs-docs ve 7 tane daha1:24.21.0-1.module_el9.8.0+321+1555b6a2 ve 4 tane daha
amazon linux 2023nodejs24, nodejs24-debuginfo, nodejs24-debugsource ve 7 tane daha1:24.21.0-1.amzn2023.0.1 ve 2 tane daha
chainguardcode-server, commercial-gitlab-rails-ee-19.1, commercial-gitlab-rails-ee-19.2 ve 11 tane daha4.139.1-r2 ve 10 tane daha
debian 12node-undicidüzeltme belirtilmemiş
debian 13node-undicidüzeltme belirtilmemiş
debian 14node-undici8.10.2+dfsg+~cs3.2.2-1
echonode-undicidüzeltme belirtilmemiş
echo npm::Echo OSVundici7.29.1
minimosghost, homepage, kibana-9.4 ve 9 tane daha6.67.0-r0 ve 11 tane daha
npm::GitHub Security Advisory npmundici7.29.1, 8.10.2
30 kaynaktaki 201 kaydın hepsini göster
KaynakPaketDüzeltildiği sürüm
alma 10nodejs241:24.21.0-1.el10_2
alma 10nodejs24-devel1:24.21.0-1.el10_2
alma 10nodejs24-docs1:24.21.0-1.el10_2
alma 10nodejs24-full-i18n1:24.21.0-1.el10_2
alma 10nodejs24-libs1:24.21.0-1.el10_2
alma 10nodejs24-npm2:11.19.0-1.24.21.0.1.el10_2
alma 8nodejs:24::nodejs1:24.21.0-1.module_el8.10.0+4292+21afb960
alma 8nodejs:24::nodejs-devel1:24.21.0-1.module_el8.10.0+4292+21afb960
alma 8nodejs:24::nodejs-docs1:24.21.0-1.module_el8.10.0+4292+21afb960
alma 8nodejs:24::nodejs-full-i18n1:24.21.0-1.module_el8.10.0+4292+21afb960
alma 8nodejs:24::nodejs-libs1:24.21.0-1.module_el8.10.0+4292+21afb960
alma 8nodejs:24::nodejs-nodemon3.1.14-2.module_el8.10.0+4250+09238ed4
alma 8nodejs:24::nodejs-packaging2021.06-6.module_el8.10.0+4086+70facd4a
alma 8nodejs:24::nodejs-packaging-bundler2021.06-6.module_el8.10.0+4086+70facd4a
alma 8nodejs:24::npm1:11.19.0-1.24.21.0.1.module_el8.10.0+4292+21afb960
alma 8nodejs:24::v8-13.6-devel3:13.6.233.17-1.24.21.0.1.module_el8.10.0+4292+21afb960
alma 9nodejs:24::nodejs1:24.21.0-1.module_el9.8.0+321+1555b6a2
alma 9nodejs:24::nodejs-devel1:24.21.0-1.module_el9.8.0+321+1555b6a2
alma 9nodejs:24::nodejs-docs1:24.21.0-1.module_el9.8.0+321+1555b6a2
alma 9nodejs:24::nodejs-full-i18n1:24.21.0-1.module_el9.8.0+321+1555b6a2
alma 9nodejs:24::nodejs-libs1:24.21.0-1.module_el9.8.0+321+1555b6a2
alma 9nodejs:24::nodejs-nodemon3.1.14-3.module_el9.8.0+292+f4eaf8b2
alma 9nodejs:24::nodejs-packaging2021.06-6.module_el9.7.0+209+ecf6523e
alma 9nodejs:24::nodejs-packaging-bundler2021.06-6.module_el9.7.0+209+ecf6523e
alma 9nodejs:24::npm1:11.19.0-1.24.21.0.1.module_el9.8.0+321+1555b6a2
alma 9nodejs:24::v8-13.6-devel3:13.6.233.17-1.24.21.0.1.module_el9.8.0+321+1555b6a2
amazon linux 2023nodejs241:24.21.0-1.amzn2023.0.1
amazon linux 2023nodejs24-debuginfo1:24.21.0-1.amzn2023.0.1
amazon linux 2023nodejs24-debugsource1:24.21.0-1.amzn2023.0.1
amazon linux 2023nodejs24-devel1:24.21.0-1.amzn2023.0.1
amazon linux 2023nodejs24-docs1:24.21.0-1.amzn2023.0.1
amazon linux 2023nodejs24-full-i18n1:24.21.0-1.amzn2023.0.1
amazon linux 2023nodejs24-libs1:24.21.0-1.amzn2023.0.1
amazon linux 2023nodejs24-libs-debuginfo1:24.21.0-1.amzn2023.0.1
amazon linux 2023nodejs24-npm1:11.19.0-1.24.21.0.1.amzn2023.0.1
amazon linux 2023v8-13.6-devel3:13.6.233.17-1.24.21.0.1.amzn2023.0.1
chainguardcode-server4.139.1-r2
chainguardcommercial-gitlab-rails-ee-19.119.1.7-r3
chainguardcommercial-gitlab-rails-ee-19.219.2.7-r1
chainguardcommercial-gitlab-rails-ee-19.319.3.3-r1
chainguardcommercial-gitlab-rails-ee-19.419.4.1-r1
chainguardcommercial-gitlab-rails-ee-fips-19.119.1.9-r0
chainguardcommercial-gitlab-rails-ee-fips-19.219.2.7-r1
chainguardcommercial-gitlab-rails-ee-fips-19.319.3.3-r1
chainguardcommercial-gitlab-rails-ee-fips-19.419.4.1-r1
chainguardhomepage2.4.0-r1
chainguardkibana-9.29.2.8-r23
chainguardlerna10.0.1-r11
chainguardnode-gyp13.0.2-r1
chainguardprism5.16.0-r14
debian 12node-undicidüzeltme belirtilmemiş
debian 13node-undicidüzeltme belirtilmemiş
debian 14node-undici8.10.2+dfsg+~cs3.2.2-1
echonode-undicidüzeltme belirtilmemiş
echo npm::Echo OSVundici7.29.1
minimosghost6.67.0-r0
minimoshomepage2.5.0-r0
minimoskibana-9.49.4.8-r0
minimoskibana-9.59.5.5-r0
minimoslangfuse-44.32.0-r0
minimosmcp-context74.1.3-r0
minimosmcp-mongodb3.1.0-r0
minimosn8n2.41.3-r0
minimosnode-gyp13.1.0-r0
minimosopenclaw2026.9.2-r0
minimospi-cli0.86.0-r0
minimostrigger-dev4.5.11-r1
npm::GitHub Security Advisory npmundici7.29.1, 8.10.2
Oracle Linux 8nodejs1:24.21.0-1.module+el8.10.0+91054+4b1a799c
Oracle Linux 8nodejs-devel1:24.21.0-1.module+el8.10.0+91054+4b1a799c
Oracle Linux 8nodejs-docs1:24.21.0-1.module+el8.10.0+91054+4b1a799c
Oracle Linux 8nodejs-full-i18n1:24.21.0-1.module+el8.10.0+91054+4b1a799c
Oracle Linux 8nodejs-libs1:24.21.0-1.module+el8.10.0+91054+4b1a799c
Oracle Linux 8nodejs-nodemon3.1.14-2.module+el8.10.0+91054+4b1a799c
Oracle Linux 8nodejs-packaging2021.06-6.module+el8.10.0+91054+4b1a799c
Oracle Linux 8nodejs-packaging-bundler2021.06-6.module+el8.10.0+91054+4b1a799c
Oracle Linux 8npm1:11.19.0-1.24.21.0.1.module+el8.10.0+91054+4b1a799c
Oracle Linux 8v8-13.6-devel3:13.6.233.17-1.24.21.0.1.module+el8.10.0+91054+4b1a799c
Oracle Linux 9nodejs1:24.21.0-1.module+el9.8.0+91053+65d3e6aa
Oracle Linux 9nodejs-devel1:24.21.0-1.module+el9.8.0+91053+65d3e6aa
Oracle Linux 9nodejs-docs1:24.21.0-1.module+el9.8.0+91053+65d3e6aa
Oracle Linux 9nodejs-full-i18n1:24.21.0-1.module+el9.8.0+91053+65d3e6aa
Oracle Linux 9nodejs-libs1:24.21.0-1.module+el9.8.0+91053+65d3e6aa
Oracle Linux 9nodejs-nodemon3.1.14-3.module+el9.8.0+91009+5d530ccd
Oracle Linux 9nodejs-packaging2021.06-6.module+el9.8.0+91009+5d530ccd
Oracle Linux 9nodejs-packaging-bundler2021.06-6.module+el9.8.0+91009+5d530ccd
Oracle Linux 9npm1:11.19.0-1.24.21.0.1.module+el9.8.0+91053+65d3e6aa
Oracle Linux 9v8-13.6-devel3:13.6.233.17-1.24.21.0.1.module+el9.8.0+91053+65d3e6aa
rapidfort alma 10nodejsdüzeltme belirtilmemiş
rapidfort alma 10nodejs-develdüzeltme belirtilmemiş
rapidfort alma 10nodejs-docsdüzeltme belirtilmemiş
rapidfort alma 10nodejs-full-i18ndüzeltme belirtilmemiş
rapidfort alma 10nodejs-libsdüzeltme belirtilmemiş
rapidfort alma 10nodejs-npmdüzeltme belirtilmemiş
rapidfort alma 10nodejs241:24.21.0-1.el10_2
rapidfort alma 10nodejs24-devel1:24.21.0-1.el10_2
rapidfort alma 10nodejs24-docs1:24.21.0-1.el10_2
rapidfort alma 10nodejs24-full-i18n1:24.21.0-1.el10_2
rapidfort alma 10nodejs24-libs1:24.21.0-1.el10_2
rapidfort alma 10nodejs24-npm2:11.19.0-1.24.21.0.1.el10_2
rapidfort alma 9nodejs1:24.21.0-1.module+el9.8.0+24924+cd677006
rapidfort alma 9nodejs-docs1:24.21.0-1.module+el9.8.0+24924+cd677006
rapidfort alma 9nodejs-full-i18n1:24.21.0-1.module+el9.8.0+24924+cd677006
rapidfort alma 9nodejs-libs1:24.21.0-1.module+el9.8.0+24924+cd677006
rapidfort alma 9nodejs-nodemon0:3.1.14-3.module+el9.8.0+24708+e71d2e1d
rapidfort alma 9npm1:11.19.0-1.24.21.0.1.module+el9.8.0+24924+cd677006
rapidfort amazon linux 2023nodejsdüzeltme belirtilmemiş
rapidfort amazon linux 2023nodejs20düzeltme belirtilmemiş
rapidfort amazon linux 2023nodejs241:24.21.0-1.amzn2023.0.1
rapidfort amazon linux 2023nodejs24-devel1:24.21.0-1.amzn2023.0.1
rapidfort amazon linux 2023nodejs24-docs1:24.21.0-1.amzn2023.0.1
rapidfort amazon linux 2023nodejs24-full-i18n1:24.21.0-1.amzn2023.0.1
rapidfort amazon linux 2023nodejs24-libs1:24.21.0-1.amzn2023.0.1
rapidfort amazon linux 2023nodejs24-npm1:11.19.0-1.24.21.0.1.amzn2023.0.1
rapidfort debian 12node-undici0:8.10.2+dfsg+~cs3.2.2-1
rapidfort debian 13node-undici0:8.10.2+dfsg+~cs3.2.2-1
rapidfort Oracle Linux 10nodejsdüzeltme belirtilmemiş
rapidfort Oracle Linux 10nodejs-develdüzeltme belirtilmemiş
rapidfort Oracle Linux 10nodejs-docsdüzeltme belirtilmemiş
rapidfort Oracle Linux 10nodejs-full-i18ndüzeltme belirtilmemiş
rapidfort Oracle Linux 10nodejs-libsdüzeltme belirtilmemiş
rapidfort Oracle Linux 10nodejs-npmdüzeltme belirtilmemiş
rapidfort Oracle Linux 10nodejs241:24.21.0-1.0.1.el10_2
rapidfort Oracle Linux 10nodejs24-devel1:24.21.0-1.0.1.el10_2
rapidfort Oracle Linux 10nodejs24-docs1:24.21.0-1.0.1.el10_2
rapidfort Oracle Linux 10nodejs24-full-i18n1:24.21.0-1.0.1.el10_2
rapidfort Oracle Linux 10nodejs24-libs1:24.21.0-1.0.1.el10_2
rapidfort Oracle Linux 10nodejs24-npm2:11.19.0-1.24.21.0.1.0.1.el10_2
rapidfort Oracle Linux 9nodejs1:24.21.0-1.module+el9.8.0+24924+cd677006
rapidfort Oracle Linux 9nodejs-devel1:24.21.0-1.module+el9.8.0+24924+cd677006
rapidfort Oracle Linux 9nodejs-docs1:24.21.0-1.module+el9.8.0+24924+cd677006
rapidfort Oracle Linux 9nodejs-full-i18n1:24.21.0-1.module+el9.8.0+24924+cd677006
rapidfort Oracle Linux 9nodejs-libs1:24.21.0-1.module+el9.8.0+24924+cd677006
rapidfort Oracle Linux 9nodejs-nodemon0:3.1.14-3.module+el9.8.0+24708+e71d2e1d
rapidfort Oracle Linux 9npm1:11.19.0-1.24.21.0.1.module+el9.8.0+24924+cd677006
rapidfort Red Hat 10nodejsdüzeltme belirtilmemiş
rapidfort Red Hat 10nodejs-develdüzeltme belirtilmemiş
rapidfort Red Hat 10nodejs-docsdüzeltme belirtilmemiş
rapidfort Red Hat 10nodejs-full-i18ndüzeltme belirtilmemiş
rapidfort Red Hat 10nodejs-libsdüzeltme belirtilmemiş
rapidfort Red Hat 10nodejs-npmdüzeltme belirtilmemiş
rapidfort Red Hat 9nodejs1:24.21.0-1.module+el9.8.0+24924+cd677006
rapidfort Red Hat 9nodejs-docs1:24.21.0-1.module+el9.8.0+24924+cd677006
rapidfort Red Hat 9nodejs-full-i18n1:24.21.0-1.module+el9.8.0+24924+cd677006
rapidfort Red Hat 9nodejs-libs1:24.21.0-1.module+el9.8.0+24924+cd677006
rapidfort Red Hat 9nodejs-nodemon0:3.1.14-3.module+el9.8.0+24708+e71d2e1d
rapidfort Red Hat 9npm1:11.19.0-1.24.21.0.1.module+el9.8.0+24924+cd677006
rapidfort rocky 10nodejsdüzeltme belirtilmemiş
rapidfort rocky 10nodejs-full-i18ndüzeltme belirtilmemiş
rapidfort rocky 10nodejs-libsdüzeltme belirtilmemiş
rapidfort rocky 9nodejs1:24.21.0-1.module+el9.8.0+40367+53e75021
rapidfort rocky 9nodejs-full-i18n1:24.21.0-1.module+el9.8.0+40367+53e75021
rapidfort rocky 9nodejs-libs1:24.21.0-1.module+el9.8.0+40367+53e75021
rapidfort rocky 9nodejs-nodemon0:3.1.14-3.module+el9.8.0+40281+14cc6568
rapidfort rocky 9npm1:11.19.0-1.24.21.0.1.module+el9.8.0+24924+cd677006
Red Hatnodejs:22::nodejsdüzeltme belirtilmemiş
Red Hatnodejs:22::nodejs-develdüzeltme belirtilmemiş
Red Hatnodejs:22::nodejs-docsdüzeltme belirtilmemiş
Red Hatnodejs:22::nodejs-full-i18ndüzeltme belirtilmemiş
Red Hatnodejs:22::nodejs-libsdüzeltme belirtilmemiş
Red Hatnodejs:22::nodejs-nodemondüzeltme belirtilmemiş
Red Hatnodejs:22::nodejs-packagingdüzeltme belirtilmemiş
Red Hatnodejs:22::nodejs-packaging-bundlerdüzeltme belirtilmemiş
Red Hatnodejs:22::npmdüzeltme belirtilmemiş
Red Hatnodejs:22::v8-12.4-develdüzeltme belirtilmemiş
Red Hatnodejs:22::v8-13.6-develdüzeltme belirtilmemiş
Red Hatnodejs:26::nodejsdüzeltme belirtilmemiş
Red Hatnodejs:26::nodejs-docsdüzeltme belirtilmemiş
Red Hatnodejs:26::nodejs-full-i18ndüzeltme belirtilmemiş
Red Hatnodejs:26::nodejs-libsdüzeltme belirtilmemiş
Red Hatnodejs:26::npmdüzeltme belirtilmemiş
rocky 10nodejs241:24.21.0-1.el10_2
rocky 10nodejs24-devel1:24.21.0-1.el10_2
rocky 10nodejs24-docs1:24.21.0-1.el10_2
rocky 10nodejs24-full-i18n1:24.21.0-1.el10_2
rocky 10nodejs24-libs1:24.21.0-1.el10_2
rocky 10nodejs24-npm2:11.19.0-1.24.21.0.1.el10_2
rocky 8nodejs:24::nodejs1:24.21.0-1.module+el8.10.0+40368+1252295d
rocky 8nodejs:24::nodejs-devel1:24.21.0-1.module+el8.10.0+40368+1252295d
rocky 8nodejs:24::nodejs-docs1:24.21.0-1.module+el8.10.0+40368+1252295d
rocky 8nodejs:24::nodejs-full-i18n1:24.21.0-1.module+el8.10.0+40368+1252295d
rocky 8nodejs:24::nodejs-libs1:24.21.0-1.module+el8.10.0+40368+1252295d
rocky 8nodejs:24::nodejs-nodemon3.1.14-2.module+el8.10.0+40278+50b003a3
rocky 8nodejs:24::nodejs-packaging2021.06-6.module+el8.10.0+40171+8fa9c325
rocky 8nodejs:24::nodejs-packaging-bundler2021.06-6.module+el8.10.0+40048+6d99f608
rocky 8nodejs:24::npm1:11.19.0-1.24.21.0.1.module+el8.10.0+40368+1252295d
rocky 8nodejs:24::v8-13.6-devel3:13.6.233.17-1.24.21.0.1.module+el8.10.0+40368+1252295d
rocky 9nodejs:24::nodejs1:24.21.0-1.module+el9.8.0+40367+53e75021
rocky 9nodejs:24::nodejs-devel1:24.21.0-1.module+el9.8.0+40367+53e75021
rocky 9nodejs:24::nodejs-docs1:24.21.0-1.module+el9.8.0+40367+53e75021
rocky 9nodejs:24::nodejs-full-i18n1:24.21.0-1.module+el9.8.0+40367+53e75021
rocky 9nodejs:24::nodejs-libs1:24.21.0-1.module+el9.8.0+40367+53e75021
rocky 9nodejs:24::nodejs-nodemon3.1.14-3.module+el9.8.0+40281+14cc6568
rocky 9nodejs:24::nodejs-packaging2021.06-6.module+el9.8.0+40164+8921ab53
rocky 9nodejs:24::nodejs-packaging-bundler2021.06-6.module+el9.7.0+40165+d075e3f2
rocky 9nodejs:24::npm1:11.19.0-1.24.21.0.1.module+el9.8.0+40367+53e75021
rocky 9nodejs:24::v8-13.6-devel3:13.6.233.17-1.24.21.0.1.module+el9.8.0+40367+53e75021
wolficode-server4.139.1-r2
wolfilerna10.0.1-r11
wolfinode-gyp13.0.2-r1
wolfiprism5.16.0-r14

Referanslar

26 referansın hepsi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.