Because BalancedPool clones its options by serializing to JSON, any function-valued TLS option—such as a checkServerIdentity callback or custom connector—is silently discarded before TLS processing. The flaw is a weakness in certificate validation (CWE‑295) that allows an attacker to present a peer certificate that the application’s custom logic intended to reject, yet which passes Node’s default hostname and chain checks. The result is that the connection is considered trusted and accepted, enabling a man‑in‑the‑middle or credential compromise scenario.

The vulnerability affects undici by undici. It is present in versions 7.24.1 up to 7.29.1 and 8.0.0 up to 8.10.2, but only when an application supplies a function-valued connect or tls option to the BalancedPool constructor. Other dispatchers—Client, Pool, and Agent—extract the options before cloning and are not impacted.

The CVSS score of 7.4 indicates a high severity flaw, and while no EPSS score is publicly available, the mitigation is straightforward: upgrading to the patched releases immediately reduces the risk. Attackers need only supply custom TLS options that the application normally uses; if they can do so, the attacker can accept forged certificates and intercept traffic. The flaw is not listed in the CISA KEV catalog, but its impact justifies prompt remediation.