Description

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the cache interceptor is composed with a downstream handler that throws during response processing (such as the built-in dump interceptor exceeding its maxSize, or the decompress interceptor rejecting more than five Content-Encoding values), a throw raised asynchronously while a cached response is replayed escapes as an uncaught exception or unhandled promise rejection and terminates the Node.js process. A malicious or compromised HTTP server can crash any such client by serving a cacheable response that triggers the throw on replay, including on a 304 revalidation of a stale entry, so the impact is availability only. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, avoid composing the cache interceptor with a response handler that throws during response processing until upgrading.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-11-06T10:16:36.497Z",
  "pubdate": "2026-11-06T10:16:36.497Z",
  "executiveSummary": "The vulnerability is an uncaught exception vulnerability within the undici HTTP client's cache interceptor mechanism.\nThis issue allows a malicious or compromised HTTP server to trigger a process-wide Denial of Service (DoS) by serving specifically crafted, cacheable HTTP responses.\nAffected products include undici versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3.\nThe vulnerability resides in the asynchronous handling of response revalidation or replay, where an unexpected error during response processing—such as exceeding buffer limits or decompression constraints—is not correctly caught by the internal promise chain.\nThe impact is strictly limited to availability, resulting in the termination of the Node.js process upon the encounter of the malformed or malicious payload during cache revalidation or replay.\nExploitation does not require authentication and can be performed remotely by any server capable of delivering a response that the client interprets as cacheable.",
  "technicalDetails": "The root cause of this vulnerability lies in improper asynchronous error handling within the undici cache interceptor pipeline. When the cache interceptor is configured with downstream handlers, such as the built-in dump interceptor or decompress interceptor, it relies on promise-based propagation to manage response data.\nThe vulnerability manifests when a cached response is being replayed or revalidated (e.g., via a 304 Not Modified status). If the downstream handler encounters a condition that triggers an exception—such as the dump interceptor exceeding a predefined maxSize, or the decompress interceptor receiving more than five Content-Encoding values—the error is raised asynchronously.\nBecause the cache interceptor does not wrap these specific asynchronous flows in a defensive try/catch block or an appropriate promise rejection handler at the integration point, the error 'escapes' the local context. In Node.js, an unhandled promise rejection or an uncaught exception originating from an asynchronous task that is not properly bubbled up will propagate to the event loop level.\nThis result is a termination of the Node.js process (crash). The attack flow is as follows: 1) The client makes an initial request to a malicious server. 2) The server provides a response designed to be cached. 3) The client caches the response locally. 4) The client performs a subsequent request (or a 304 revalidation) for the same resource. 5) During the replay of the cached response, the downstream handler triggers an exception. 6) The error remains uncaught, leading to an immediate process crash.\nThis vulnerability is highly effective because it persists even after the initial connection, as the exploit is triggered by the retrieval of the cached asset. The lack of validation on the error propagation path within the interceptor chain makes this a critical availability flaw for Node.js applications relying on undici as their primary HTTP client."
}