undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation
CVSS score
7.5
EPSS probability
%0.2
Risk score
0.0
Published
3 d ago
Kanıt listesindeki ürün ve sürüm eşleşmesini kontrol edin; bazı varyantlar hâlâ etkileniyor olabilir.
Impact on My Inventory
Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.
Checking session…
Vulnerability description
CVE AI research
DayBreach AI Explanation
Verified against sourcesSources read
2
Source agreement
Tam uyum
Evidence confidence
%61
Short explanation
undici versions 4.2.1‑6.29.0, 7.0.0‑7.30.0 and 8.0.0‑8.12.1 can crash the Node.js process when a TLS 1.2 server renegotiates and presents a different, valid certificate whose hostname does not match the request. The client’s error handler asserts this cannot occur, turning the error into an uncaught assertion that terminates the process, causing denial‑of‑service.
A single server‑initiated renegotiation can bring down applications that use undici or the global fetch(), leading to service outage.
What should be done?
- Upgrade undici to 6.29.1, 7.30.1, 8.12.2 or later
- Restrict outbound connections to TLS 1.3 where possible
- Follow vendor security advisory
- Add monitoring for process crashes
- Account for unknown patch status
The sources give limited detail on some technical conditions. Review the chain of evidence below before deciding how to act.
Chain of evidence and sources
undici, TLS 1.2 yeniden müzakere sırasında farklı bir geçerli sertifika alındığında süreci çökerten bir istismar açığı içerir (S0).
Etkilenen sürümler 4.2.1‑6.29.0, 7.0.0‑7.30.0 ve 8.0.0‑8.12.1 arasındadır (S0).
Sorun, undici 6.29.1, 7.30.1 ve 8.12.2 sürümlerinde düzeltilmiştir (S0).
Show the technical text from the sources
undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-248, CWE-617
Explanation produced with the local gemini-flash-lite-latest model. Numerical metrics and the KEV, patch and exploit statuses are not determined by AI.
IMPACT: Affected Products and Software
Affected Products
The following products are affected by CVE-2026-87018 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.
RED HAT CSAF/VEX: Product Impact Check
SCORING: CVSS from Multiple Sources
CVSS Scores
The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.
| SCORE | VERSION | SEVERITY | VECTOR | SOURCE |
|---|---|---|---|---|
| 7.5 | CVSS V3_1 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | CVE CNA |
| 7.5 | CVSS V31 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD |
Patch and Remediation Guide
Solution & Remediation Advisory
1 düzeltme kanıtı bulundu; en az 3 ürün veya sürüm hâlâ etkileniyor ya da inceleniyor.
8.12.2+dfsg+~cs3.2.3-1Debian sid: 8.12.2+dfsg+~cs3.2.3-1
Public exploit and active exploitation status
Verified exploit intelligence
No verified public PoC, exploit repository or Metasploit module has been found for this CVE yet.
Weakness Classification and Attack Patterns (CWE & CAPEC)
CWE - Common Weakness Enumeration
While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-87018 is associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-87018 weaknesses.
Attack Vector and Accessibility
Official Sources and Advisories
Similar Vulnerabilities
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-87018"