Undici, the HTTP client library for Node.js, contains a flaw that causes the Node.js process to terminate when a TLS 1.2 server initiates a renegotiation after the initial handshake and supplies a different, CA‑trusted certificate whose host name does not match the request target. Undici’s error handler incorrectly assumes that the socket close error produced by this condition can never happen, turning the normally handled hostname‑altname error into an uncaught assertion that kills the process. The denial of service can be triggered with a single server‑initiated renegotiation, bringing all in‑flight requests and background work to an abrupt halt. The attacker only needs to control an HTTPS endpoint that undici contacts, and no CA compromise is necessary because two ordinary valid certificates can be presented.

Vulnerable releases include undici versions 4.2.1‑6.29.0, 7.0.0‑7.30.0, and 8.0.0‑8.12.1. The fix is delivered in v6.29.1, v7.30.1, and v8.12.2 and later releases. Applications that import undici or use Node.js’s global fetch() and rely on those affected ranges are at risk.

With a CVSS score of 7.5, the vulnerability is considered high severity. No EPSS score is available, and it is not yet listed in the CISA KEV catalog. An attacker can exploit the flaw from any remote system that undici communicates with, simply by performing the renegotiation that violates hostname expectations. Because TLS 1.3 disables renegotiation, restricting outbound connections to TLS 1.3 removes the attack surface.