UBUNTU-CVE-2026-87018

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-87018
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-87018.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-87018
Upstream
Published
2026-10-16T00:00:00Z
Modified
2026-10-17T13:01:14Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it.

References

Affected packages

Ubuntu:24.04:LTS / node-undici

Package

Name
node-undici
Purl
pkg:deb/ubuntu/node-undici?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

5.*
5.22.1+dfsg1+~cs20.10.10.2-1ubuntu1
5.26.3+dfsg1+~cs23.10.12-2

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "node-llhttp",
            "binary_version":  "9.1.3~5.26.3+dfsg1+~cs23.10.12-2"
        },
        {
            "binary_name":  "node-undici",
            "binary_version":  "5.26.3+dfsg1+~cs23.10.12-2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-87018.json"

Ubuntu:26.10 / node-undici

Package

Name
node-undici
Purl
pkg:deb/ubuntu/node-undici?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

7.*
7.18.2+dfsg+~cs3.2.0-1build1
7.24.6+dfsg+~cs3.2.0-3
8.*
8.5.0+dfsg+~cs3.2.0-2
8.5.0+dfsg+~cs3.2.0-3
8.9.0+dfsg+~cs3.2.0-1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "node-undici",
            "binary_version":  "8.9.0+dfsg+~cs3.2.0-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-87018.json"

Ubuntu:26.04:LTS / node-undici

Package

Name
node-undici
Purl
pkg:deb/ubuntu/node-undici?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

7.*
7.3.0+dfsg1+~cs24.12.11-2
7.16.0+dfsg+~cs3.2.0-2
7.18.2+dfsg+~cs3.2.0-1
7.18.2+dfsg+~cs3.2.0-1build1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "node-undici",
            "binary_version":  "7.18.2+dfsg+~cs3.2.0-1build1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-87018.json"