Undici flaw bypasses custom TLS certificate validation

CVE-2026-109383 (CVSS 7.4) in Node.js's undici HTTP client: the Agent constructor clones options via JSON, silently dropping callbacks like tls.checkServerIdentity. This lets an attacker with a CA-trusted certificate intercept traffic. Fixed in undici 6.29.1, 7.30.1 and 8.12.2.

• CVE-2026-109383 has a CVSS score of 7.4 and a POC
• Affected: undici 4.0.0–6.29.0, 7.0.0–7.30.0, 8.0.0–8.12.1
• Patched in undici 6.29.1, 7.30.1 and 8.12.2
• Workaround: pass TLS callbacks via the connect option