Detections
Analytics

SCA: security update for undici (GHSA-2m5v-pch6-74hx)

critical Tenable Cloud Security Plugin ID 477581

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and
 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone
 before forwarding them to each per-origin pool, and because JSON cannot represent functions, a caller-
 supplied tls option containing a checkServerIdentity callback is silently dropped before it reaches the
 TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reject,
 but which passes Node's default hostname and chain checks, is silently accepted. Because Agent is the
 default dispatcher behind request, fetch, and setGlobalDispatcher, this affects the path most applications
 use, and EnvHttpProxyAgent is affected on its direct and no-proxy routes as well, while only applications
 that pass a function-valued tls option such as a custom checkServerIdentity for certificate or public-key
 pinning are at risk. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which preserve the tls
 option outside the JSON clone so custom verification callbacks are forwarded unchanged, and users should
 upgrade to one of those versions or later. As a workaround, pass the TLS options through connect instead
 of tls, or for proxied destinations use requestTls and proxyTls. (CVE-2026-109383)

Solution

Update the undici library and its related packages to version 6.29.1 or later.

See Also

https://github.com/advisories/GHSA-2m5v-pch6-74hx

Plugin Details

Severity: Critical

ID: 477581

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/27/2026

Updated: 10/27/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.49

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2026-109383

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/27/2026

Vulnerability Publication Date: 10/15/2026

Reference Information

CVE: CVE-2026-109383

IAVA: 2026-A-1200

cwe: CWE-295