Horizon Alert
Summary of the vulnerability and why it matters
This advisory details a critical vulnerability in the undici HTTP client library for Node.js. The issue could allow an attacker to bypass custom server identity checks, potentially leading to connections to untrusted servers if specific, advanced TLS verification configurations are in place. The core concern is the silent dropping of custom security callbacks during certificate validation.
- Undici library fails custom server certificate checks.
- Affects custom TLS verification in Node.js apps.
- Confirm if custom certificate checks are used.
Attack Path
How an attacker could exploit the issue
An attacker could exploit this vulnerability by presenting a malicious TLS certificate to a Node.js application using the undici HTTP client library. If the application has implemented a custom `checkServerIdentity` function for certificate validation that relies on `JSON.parse` to process TLS options, this function could be silently dropped. This allows the attacker's certificate, which might fail custom checks but pass Node.js's default checks, to be accepted, potentially leading to man-in-the-middle attacks.
- Requires custom TLS verification callback.
- Attacker presents a certificate.
- Bypasses custom certificate checks.
Live Threat
Current exploitation, exposure, and threat context
When supported by the advisory, a custom TLS certificate verification callback could be bypassed, allowing an attacker to impersonate a legitimate server. This is a risk for applications that use a custom `checkServerIdentity` function for certificate pinning or other advanced verification needs, as the callback might be silently dropped by the `undici` library's cloning process. The Node.js `Agent` is the default dispatcher for common functions like `request` and `fetch`, increasing the potential reach of this vulnerability.
- Custom TLS verification logic.
- Callbacks are silently dropped.
- Unwanted TLS connections may occur.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability in the Node.js undici HTTP client library requires action from teams responsible for Node.js application development and security. The first practical step is to identify all Node.js applications utilizing undici, determine if they perform custom TLS certificate verification, and then plan remediation based on the risk of unverified TLS peers.
- Application owners must own this issue.
- Verify custom certificate validation logic.
- Upgrade undici or implement workarounds.
