Unhandled exception in undici cache interceptor crashes Node.js process
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-248.
Summary
undici, an HTTP client for Node.js, is affected from 7.0.0 before 7.30.2 and from 8.0.0 before 8.12.4. When the cache interceptor is composed with a downstream handler that throws during response processing, an error raised asynchronously while a cached response is replayed is not caught. A malicious or compromised HTTP server can serve a cacheable response that triggers this on replay, crashing the Node.js process. The impact is limited to availability.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the cache interceptor is composed with a downstream handler that throws during response processing (such as the built-in dump interceptor exceeding its maxSize, or the decompress interceptor rejecting more than five Content-Encoding values), a throw raised asynchronously while a cached response is replayed escapes as an uncaught exception or unhandled promise rejection and terminates the Node.js process. A malicious or compromised HTTP server can crash any such client by serving a cacheable response that triggers the throw on replay, including on a 304 revalidation of a stale entry, so the impact is availability only. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, avoid composing the cache interceptor with a response handler that throws during response processing until upgrading.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
Upgrade undici to 7.30.2 or 8.12.4, which fix the issue. Until upgrading, avoid composing the cache interceptor with a response handler that throws during response processing.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA undici (undici) Fixed in 7.30.2, 8.12.4
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
undici 7.30.2, 8.12.4
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2026-85807 Cache poisoning in undici via intermediate redirect hopsPriority LOW 32
- TI-2026-85805 Cross-user cache disclosure in undici via same-origin redirectPriority LOW 29
- TI-2026-85809 undici leaks cross-origin credentials via array-of-tuples headers on redirectPriority LOW 26
Timeline
- 2026-11-06 Threatist record created from CVE-2026-120222
- 2026-11-08 Priority changed: MEDIUM → LOW
References
More NodeJS vulnerabilities
- TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2024-18584 Race condition in NodeJS Node CVSS 3.0HIGH 8.2
- TI-2016-01993 The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other… CVSS 3.1HIGH 7.5
- TI-2024-03325 Command injection vulnerability in programing languages on Microsoft Windows operating system. CVSS 3.1CRITICAL 9.8
- TI-2022-03472 X.509 Email Address Variable Length Buffer Overflow CVSS 3.1HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences