Five undici advisories hit, including a TLS validation bypass

undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent nodejs/undici

The Agent drops tls options on some code paths, so certificate validation runs with defaults instead of your configuration. For services that pin a CA or set rejectUnauthorized explicitly, that is the difference between a verified peer and an accepted one, and it outranks everything else in this period.

undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake nodejs/undici

A failed HTTP/2 handshake in the WebSocket client is enough to take the process down. Node 26.12.0 and 24.22.0 ship the fixed undici; out-of-tree deployments get it only by upgrading undici itself.

undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects nodejs/undici

Cross-origin redirects can end with one user's cached response served to another. Caches sitting behind undici are the exposed surface, so this is the advisory to read before any of the DoS ones.

undici vulnerable to Denial of Service via unbounded memory in the EventSource parser nodejs/undici

The EventSource parser grows memory without bound as it reads. Anything consuming a server-sent-events feed from a source it does not fully control is on the receiving end of that one.

undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens nodejs/undici

SRI checks compare algorithm tokens literally, so a non-lowercase token skips the integrity check instead of failing it. Another reason to read the advisories as a set rather than patching the one that matches your stack.

2026-10-14, Version 24.22.0 'Krypton' (LTS), @richardlau prepared by @aduh95 nodejs/node

by richardlau

Krypton adds crypto.parsePKCS12(), a semver-minor under Node's own rules and therefore inside an LTS line. Teams whose PKCS#12 handling lives in userland now have a supported path for it; the release also carries the undici WebSocket DoS fix.

2026-10-14, Version 26.12.0 (Current), @richardlau nodejs/node

by richardlau

Current builds now throw when WebAssembly or RX support is missing rather than proceeding without it. That changes behaviour for anything relying on WASM on constrained or unusual targets, and the same release carries the undici WebSocket DoS patch.

v8.12.0 nodejs/undici

by github-actions[bot]

Alongside the advisories: cookies ignore a numeric expires outside the Date range, HTTP/2 pauses bodyTimeout while applying backpressure, and cache tracks cached response aborts.