Cross-user cache disclosure in undici via same-origin redirect
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
undici, an HTTP client for Node.js, is affected from 7.0.0 before 7.30.2 and from 8.0.0 before 8.12.4. When the redirect interceptor and a shared response cache are used together, a response to an authenticated request that is redirected to a same-origin target is stored under the original request's cache key, which omits the credential and has no Vary header. A later anonymous or different user can then receive the first user's private response body, a cache disclosure weakness (CWE-524). No privileges or user interaction are required, though attack complexity is rated high.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the redirect interceptor and a shared response cache are used together, an authenticated request that is redirected to a same-origin target has the final response stored under the original request's cache key. That key omits the credential and carries no Vary header, so a later anonymous or different user can be served the first user's private response body. This results in cross-user disclosure of cached private responses. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
Upgrade undici to version 7.30.2 for the 7.x line or 8.12.4 for the 8.x line, or a later release.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA undici (undici) Fixed in 7.30.2, 8.12.4
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
undici 7.30.2, 8.12.4
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2026-85807 Cache poisoning in undici via intermediate redirect hopsPriority LOW 32
- TI-2026-85809 undici leaks cross-origin credentials via array-of-tuples headers on redirectPriority LOW 26
- TI-2026-85808 Unhandled exception in undici cache interceptor crashes Node.js processPriority LOW 26
Timeline
- 2026-11-06 Threatist record created from CVE-2026-120474
- 2026-11-07 Priority changed: MEDIUM → LOW
References
More NodeJS vulnerabilities
- TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2024-18584 Race condition in NodeJS Node CVSS 3.0HIGH 8.2
- TI-2016-01993 The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other… CVSS 3.1HIGH 7.5
- TI-2024-03325 Command injection vulnerability in programing languages on Microsoft Windows operating system. CVSS 3.1CRITICAL 9.8
- TI-2022-03472 X.509 Email Address Variable Length Buffer Overflow CVSS 3.1HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences