Zero Radar
← feed
HighVulnerabilityCVE-2026-87018updated 27 Oct 2026, 19:02 UTC

undici HTTP client can crash Node.js when a TLS 1.2 server renegotiates

A server you connect to over HTTPS can make the Node.js program that calls it shut down completely. This happens when the server switches its encryption setup partway through a connection and presents a certificate that does not match the s

Fixed in 6.29.1, 7.30.1, 8.12.2Official source
SeverityHighCVSS 7.5 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yes6.29.1, 7.30.1, 8.12.2 · since 27 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Malicious serverControls an HTTPS endpoint your app calls
  2. 2TLS 1.2 renegotiationServer switches setup mid-connection
  3. 3Mismatched certificateValid cert, but wrong hostname
  4. 4undici assertsUnexpected error becomes uncaught exception
  5. 5Process crashesNode.js process terminates
  6. ResultClient process terminates, dropping all work

What happened

undici's established-socket error handler asserts that Node.js's ERR_TLS_CERT_ALTNAME_INVALID error can never occur, so a peer-triggered renegotiation with a hostname-mismatched certificate causes an uncaught AssertionError that terminates the process. Affects HTTP/1.1 and HTTP/2 paths and is limited to TLS 1.2.

Why it is dangerous: A single malicious or compromised HTTPS endpoint can crash the client process, killing all in-flight requests and background work. No certificate authority compromise is needed.

Are you affected?

You are affected if your Node.js application uses undici or the global fetch() to make outbound HTTPS requests to TLS 1.2 endpoints and you run an affected undici version.

Package / productAffected versionsFixed in
undici · npm>= 4.2.1, < 6.29.16.29.1
undici · npm>= 7.0.0, < 7.30.17.30.1
undici · npm>= 8.0.0, < 8.12.28.12.2

What to do

  1. Upgrade undici to 6.29.1, 7.30.1, or 8.12.2 depending on your major version.
  2. If you cannot upgrade yet, restrict outbound connections to TLS 1.3 where the target servers support it, by setting minVersion and maxVersion to 'TLSv1.3' on the client or agent.
  3. Check your lockfile and dependencies to confirm no older undici copy is still in use.

Timeline

  1. 27 Oct 2026, 19:02 UTC
    Publicly disclosed
  2. 27 Oct 2026, 19:02 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 27 Oct 2026, 19:02 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm
CVSS
7.5 / 10
EPSS
0.2% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 19:02 UTC
On Zero Radar
27 Oct 2026, 19:02 UTC (1 min after disclosure)
Last change
27 Oct 2026, 19:02 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

undici HTTP client can crash Node.js when a TLS 1.2 server renegotiates · Zero Radar