CVE-2026-84961 is a certificate validation flaw in the Node.js undici HTTP client (CVSS 7.4, high). BalancedPool silently drops function valued TLS options, so a custom checkServerIdentity never runs. Upgrade to undici 7.29.1 or 8.10.2. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
The advisory lists undici from 7.24.1 up to but not including 7.29.1, and from 8.0.0 up to but not including 8.10.2. Patched releases are 7.29.1 and 8.10.2. The weakness is CWE-295, improper certificate validation.
Only applications that pass a function valued connect or tls option, such as a custom checkServerIdentity or connector, to BalancedPool are affected. The Client, Pool, Agent and RoundRobinPool dispatchers extract those options before cloning and are not affected. The record is not in the CISA KEV catalog.
How to check if you're exposed
List the undici versions in your tree, including copies pulled in by other packages.
npm ls undici
Then search your own code for BalancedPool and see whether you pass a checkServerIdentity function or a custom connector.
grep -rn "BalancedPool" src/
Node.js bundles its own undici copy, so also check the advisory for your runtime line.
What to do now
- Run npm ls undici across your services and note every version in the affected ranges.
- Upgrade to 7.29.1 or 8.10.2 or later, directly or through the package that depends on it.
- Search for BalancedPool use with custom TLS options. Those are the exposed call sites.
- Until you upgrade, avoid BalancedPool for connections that rely on a custom certificate check, or use Pool or Agent instead.
- Rebuild and redeploy, then rerun the dependency scan.
Why it matters
The bug is a quiet one. The constructor copied its options by turning them into JSON and back, and JSON cannot hold functions. The callback vanished, no error was raised, and the connection proceeded with only Node's default checks.
That is exactly the situation where a pinned certificate or custom identity rule was meant to be stricter than the default. The reachability question matters here: a vulnerable undici in your tree is not a problem unless your code reaches BalancedPool with those options.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
If I only use fetch, am I affected?
The advisory says only BalancedPool with a function valued connect or tls option is affected. Check how your code builds its dispatcher before assuming either way.
Sources
Last reviewed: 19 October 2026.
