undici's Agent component improperly handles TLS options by deep cloning constructor options via JSON serialization, which drops function-valued TLS callbacks such as checkServerIdentity. This results in a TLS certificate validation bypass where custom verification logic is ignored, potentially allowing acceptance of TLS peers that should be rejected. The vulnerability affects applications using Agent as the default dispatcher for request, fetch, and setGlobalDispatcher, as well as EnvHttpProxyAgent on certain routes. Fixed in undici versions 6.29.1, 7.30.1, and 8.12.2.