CVE catalog

CVE-2026-87018

node-undici: CVE-2026-87018

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Oct 15, 2026, 6:38:25 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.19% · Oct 25, 2026

undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	node-undici	sid	`8.12.2+dfsg+~cs3.2.3-2`	fixed
Debian	node-undici	forky	`8.10.2+dfsg+~cs3.2.2-1`	vulnerable
Debian	node-undici	trixie	`7.3.0+dfsg1+~cs24.12.11-1`	vulnerable
Debian	node-undici	bookworm	`5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4`	vulnerable
Debian	node-undici	bookworm-security	`5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3`	vulnerable
Cpe	undici	Not reported	`8.12.2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	node-undici	source	sid	`8.12.2+dfsg+~cs3.2.3-1`	not yet assigned	Not reported	Not reported
Debian	node-undici	source	forky	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	node-undici	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	node-undici	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported
Cpe	undici	cpe	Not reported	`8.12.2`	Not reported	NVD-CVE-2026-87018	Not reported

Notes

[trixie] node-undici: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[node-llhttp]Affected
Source package: [node-undici]
Details (4)
- 8.1.0~5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4 · all · bookworm
  Affected
  dsa · node-undici · debian · bookworm; dsa · node-undici · debian · 12
- 8.1.0~5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4 · all · bookworm
  Affected
  dsa · node-undici · debian · bookworm; dsa · node-undici · debian · 12
- 8.1.0~5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3 · all · bookworm-security
  Affected
  dsa · node-undici · debian · bookworm; dsa · node-undici · debian · 12
- 8.1.0~5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3 · all · bookworm-security
  Affected
  dsa · node-undici · debian · bookworm; dsa · node-undici · debian · 12
[node-undici]Affected
Details (4)
- 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4 · all · bookworm
  Affected
  dsa · node-undici · debian · bookworm; dsa · node-undici · debian · 12
- 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4 · all · bookworm
  Affected
  dsa · node-undici · debian · bookworm; dsa · node-undici · debian · 12
- 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3 · all · bookworm-security
  Affected
  dsa · node-undici · debian · bookworm; dsa · node-undici · debian · 12
- 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3 · all · bookworm-security
  Affected
  dsa · node-undici · debian · bookworm; dsa · node-undici · debian · 12

[Debian 13 (Trixie)]

[libllhttp9.2]Affected
Source package: [node-undici]
Details (2)
- 9.2.1~7.3.0+dfsg1+~cs24.12.11-1 · amd64 · trixie
  Affected
  dsa · node-undici · debian · 13
- 9.2.1~7.3.0+dfsg1+~cs24.12.11-1 · arm64 · trixie
  Affected
  dsa · node-undici · debian · 13
[libllhttp-dev]Affected
Source package: [node-undici]
Details (2)
- 9.2.1~7.3.0+dfsg1+~cs24.12.11-1 · amd64 · trixie
  Affected
  dsa · node-undici · debian · 13
- 9.2.1~7.3.0+dfsg1+~cs24.12.11-1 · arm64 · trixie
  Affected
  dsa · node-undici · debian · 13
[node-llhttp]Affected
Source package: [node-undici]
Details (2)
- 9.2.1~7.3.0+dfsg1+~cs24.12.11-1 · all · trixie
  Affected
  dsa · node-undici · debian · 13
- 9.2.1~7.3.0+dfsg1+~cs24.12.11-1 · all · trixie
  Affected
  dsa · node-undici · debian · 13
[node-undici]Affected
Details (2)
- 7.3.0+dfsg1+~cs24.12.11-1 · all · trixie
  Affected
  dsa · node-undici · debian · 13
- 7.3.0+dfsg1+~cs24.12.11-1 · all · trixie
  Affected
  dsa · node-undici · debian · 13

Observed: Oct 24, 2026, 8:59:42 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]