CVE-2026-87018

A flaw was found in undici. A remote server can cause a Denial of Service (DoS) by initiating a Transport Layer Security (TLS) renegotiation and presenting a certificate with a mismatched hostname. Because the client application fails to properly handle the resulting verification error, an uncaught assertion is triggered, terminating the client process and disrupting active network requests.

This vulnerability is evaluated as an Important severity flaw for Red Hat products because an unauthenticated remote server can terminate a client Node.js process, halting all concurrent tasks and in-flight operations. In typical Red Hat deployments, containerized microservices and administrative consoles rely on undici or runtime fetch APIs to communicate with external web endpoints. Exploitation requires the client application to establish an outbound TLS 1.2 connection to a malicious or compromised endpoint that initiates session renegotiation with a non-matching certificate. Workloads communicating strictly with trusted endpoints or utilizing TLS 1.3 connections are inherently protected, as TLS 1.3 does not permit server-driven renegotiation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.