Description

undici is an HTTP client for Node.js. In versions 7.30.1 and 8.12.2 through 8.12.3, when an originless Agent composes the redirect and shared cache interceptors, undici decides whether to store the final response under the original request key by inspecting only the final redirect hop, which bypasses the earlier fix for CVE-2026-109829 that compared only the initial and final origins. A redirect that bounces through an untrusted origin and returns to the trusted origin is still cached under the trusted key, an intermediate hop's Vary is dropped so a response that varies on Authorization or Cookie can be served to a different user, and an intermediate hop's no-cache or default-uncacheable status is ignored so a non-storable redirect is laundered into a cacheable entry. An attacker who controls a redirect target from a trusted URL can poison the cached entry for that URL or have a private, per-user response served to a later caller. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, compose the interceptors as cache then redirect, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-11-06T10:16:36.313Z",
  "pubdate": "2026-11-06T10:16:36.313Z",
  "executiveSummary": "A vulnerability in the Undici HTTP client allows for cache poisoning and unauthorized information disclosure via improper request-response validation during redirects.\nThe flaw affects versions 7.30.1 and 8.12.2 through 8.12.3, specifically when an originless Agent utilizes a combination of redirect and shared cache interceptors.\nBy manipulating redirect paths, an attacker can cause the client to cache sensitive, per-user responses (e.g., those containing Authorization or Cookie headers) under a trusted URL key, or store non-cacheable content by bypassing security checks.\nThis vulnerability bypasses previously implemented security controls (CVE-2026-109829) by failing to validate intermediate redirect hops, allowing responses from untrusted origins to be associated with trusted cache keys.\nExploitation allows an attacker to poison shared caches or serve private user data to subsequent callers, posing a significant risk to confidentiality and data integrity within applications relying on Undici's shared cache implementation.",
  "technicalDetails": "The vulnerability resides within the interaction between the redirect interceptor and the shared cache interceptor in the Undici Node.js HTTP client. When an originless Agent is configured, the system improperly evaluates whether to store a final response by inspecting only the terminal hop of a redirect chain.\nThis logic flaw enables a 'redirect laundering' attack. If a request is redirected through an untrusted origin and subsequently returns to a trusted origin, Undici fails to verify the integrity of the intermediate hops. Instead of rejecting the chain or isolating the cache, the client incorrectly stores the final response under the original trusted URL request key.\nThe technical impact is twofold: First, the system drops the 'Vary' header information provided by intermediate hops. If an intermediate response relies on sensitive headers such as 'Authorization' or 'Cookie', the resulting cached entry fails to properly differentiate by user identity, potentially serving one user's private data to another. Second, the client ignores 'no-cache' directives or default-uncacheable statuses present in intermediate hops. This allows an attacker to bypass cache-control headers, effectively laundering a non-storable resource into a permanently cached, trusted entry.\nThe attack flow proceeds as follows: 1) An attacker forces a client to perform a request to a trusted URL that triggers a redirect chain. 2) The chain includes an attacker-controlled intermediate origin that serves malicious or private-specific content. 3) The redirect ultimately returns to a resource that appears trusted by the final logic check. 4) Undici's shared cache interceptor erroneously caches the payload using the key of the initial trusted request. 5) Subsequent legitimate requests to that trusted key retrieve the poisoned/private cached object instead of the correct resource.\nThis behavior specifically overrides the previous fix for CVE-2026-109829, which relied on comparing only the initial and final origins. Because the current implementation neglects the intermediate hops entirely, the origin-comparison check becomes insufficient to prevent cache pollution. The vulnerability persists in versions 7.30.1 and 8.12.2 through 8.12.3, requiring an upgrade to 7.30.2 or 8.12.4 to resolve the underlying logic error in the interceptor chain."
}