THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-84961 (HIGH 7.4) — undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a c

[NVD] CVE-2026-84961 (HIGH 7.4) — undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a c

mednvdPublished 2026-09-04

CVE-2026-84961 CVSS: 7.4 HIGH Published: 2026-09-04T17:17:02.227

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently

Indicators of compromise

CVE-2026-84961cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-84961