Node.js undici DoS via TLS 1.2 renegotiation disclosed

CVE-2026-87018 (CVSS 7.5) in undici, the HTTP client behind Node.js global fetch(), lets a remote TLS 1.2 server crash the Node.js process by renegotiating after the handshake with a hostname-mismatched certificate, triggering an uncaught AssertionError. Fixed in undici 6.29.1, 7.30.1 and 8.12.2.

• CVSS 7.5, CWE-617/CWE-248, proof-of-concept regression test available
• Affects undici 4.2.1–6.29.0, 7.0.0–7.30.0 and 8.0.0–8.12.1
• Patches released in 6.29.1, 7.30.1 and 8.12.2
• Mitigation: upgrade undici or enforce TLS 1.3