undici is vulnerable to a denial of service condition triggered by a TLS 1.2 server-initiated renegotiation presenting a different, valid but hostname-mismatched certificate. This causes an uncaught assertion error that crashes the Node.js client process, affecting both HTTP/1.1 and HTTP/2. Only TLS 1.2 is impacted, as TLS 1.3 does not support renegotiation. The issue is fixed in undici versions 6.29.1, 7.30.1, and 8.12.2. Mitigation includes upgrading to these versions or restricting connections to TLS 1.3 to prevent renegotiation.