Cache poisoning in undici via intermediate redirect hops
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-346.
Summary
undici from 7.30.1 before 7.30.2 and from 8.12.2 before 8.12.4 checks only the final redirect hop before caching a response (CWE-346). A redirect through an untrusted origin that returns to a trusted origin is cached under the trusted key, and an intermediate hop's Vary and no-cache rules are ignored. An attacker who controls a redirect target on a trusted URL can poison the cached entry or get a private response served to another user.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
undici is an HTTP client for Node.js. In versions 7.30.1 and 8.12.2 through 8.12.3, when an originless Agent composes the redirect and shared cache interceptors, undici decides whether to store the final response under the original request key by inspecting only the final redirect hop, which bypasses the earlier fix for CVE-2026-109829 that compared only the initial and final origins. A redirect that bounces through an untrusted origin and returns to the trusted origin is still cached under the trusted key, an intermediate hop's Vary is dropped so a response that varies on Authorization or Cookie can be served to a different user, and an intermediate hop's no-cache or default-uncacheable status is ignored so a non-storable redirect is laundered into a cacheable entry. An attacker who controls a redirect target from a trusted URL can poison the cached entry for that URL or have a private, per-user response served to a later caller. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, compose the interceptors as cache then redirect, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
Upgrade undici to version 7.30.2 or 8.12.4. As a workaround, compose the cache and redirect interceptors as cache then redirect, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA undici (undici) Fixed in 7.30.2, 8.12.4
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
undici 7.30.2, 8.12.4
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2026-85805 Cross-user cache disclosure in undici via same-origin redirectPriority LOW 29
- TI-2026-85809 undici leaks cross-origin credentials via array-of-tuples headers on redirectPriority LOW 26
- TI-2026-85808 Unhandled exception in undici cache interceptor crashes Node.js processPriority LOW 26
Timeline
- 2026-11-06 Threatist record created from CVE-2026-116592
- 2026-11-08 Priority changed: MEDIUM → LOW
References
More NodeJS vulnerabilities
- TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2024-18584 Race condition in NodeJS Node CVSS 3.0HIGH 8.2
- TI-2016-01993 The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other… CVSS 3.1HIGH 7.5
- TI-2024-03325 Command injection vulnerability in programing languages on Microsoft Windows operating system. CVSS 3.1CRITICAL 9.8
- TI-2022-03472 X.509 Email Address Variable Length Buffer Overflow CVSS 3.1HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences