Search: CVE-2026-84961

Node.js undici library's BalancedPool constructor improperly handles TLS options by deep cloning its options via JSON serialization, which drops function-valued TLS options such as custom checkServerIdentity callbacks. This leads to TLS certificate validation bypass when using BalancedPool with such custom callbacks, allowing acceptance of TLS peers that should be rejected. Other undici components like Client, Pool, and Agent are not affected. The issue is fixed in versions 7.29.1 and 8.10.2.