undici information disclosure via cross-origin redirect revalidation
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-346.
Summary
undici, an HTTP client for Node.js, is affected from 7.0.0 before 7.30.2 and from 8.0.0 before 8.12.4. With redirect and shared cache interceptors composed in an Agent, a conditional revalidation of a cached response can receive a 304 from another origin, because the redirect handler keeps the cache's If-None-Match or If-Modified-Since validators while stripping origin-bound credentials. A remote attacker who can trigger a cross-origin redirect of that request can make a shared cache serve the original origin's stored authenticated response, including one gated by Authorization, to an unauthenticated caller. The flaw is CWE-346.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when an Agent composes the redirect and shared cache interceptors, a cached response that is revalidated with a conditional request can be validated by a 304 Not Modified from a different origin. When the origin that stored the response redirects the conditional revalidation request to another origin, the redirect handler strips origin-bound credential headers but not the cache-generated If-None-Match or If-Modified-Since validators, so the redirect destination receives the original origin's validator and undici treats its 304 as successful revalidation of the stored representation. As a result, a shared cache can serve the original origin's stored authenticated response, including one gated by Authorization, to a later unauthenticated caller. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, compose the interceptors as cache then redirect, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
Upgrade undici to 7.30.2 or 8.12.4 or later, which fix this issue. As a workaround, compose the interceptors as cache then redirect, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA undici (undici) Fixed in 7.30.2, 8.12.4
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
undici 7.30.2, 8.12.4
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2026-85807 Cache poisoning in undici via intermediate redirect hopsPriority LOW 32
- TI-2026-85805 Cross-user cache disclosure in undici via same-origin redirectPriority LOW 29
- TI-2026-85809 undici leaks cross-origin credentials via array-of-tuples headers on redirectPriority LOW 26
Timeline
- 2026-11-06 Threatist record created from CVE-2026-116630
- 2026-11-08 Priority changed: MEDIUM → LOW
References
More NodeJS vulnerabilities
- TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2024-18584 Race condition in NodeJS Node CVSS 3.0HIGH 8.2
- TI-2016-01993 The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other… CVSS 3.1HIGH 7.5
- TI-2024-03325 Command injection vulnerability in programing languages on Microsoft Windows operating system. CVSS 3.1CRITICAL 9.8
- TI-2022-03472 X.509 Email Address Variable Length Buffer Overflow CVSS 3.1HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences