Description

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream origin is returned for a request to a different, trusted origin whenever the method, path, and relevant headers match, which permits cross-origin information disclosure and persistent cache poisoning. The reporter demonstrated a full authentication bypass in which a JWT signed with an attacker-controlled key was accepted as belonging to a trusted issuer, and the trusted origin was never contacted. This is a regression introduced in 8.10.0 and affects undici versions from 8.10.0 up to 8.10.2. Applications using an Agent, which carries the origin in its dispatch options, are not affected. Users should upgrade to undici 8.10.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-09-04T17:17:02.717Z",
  "pubdate": "2026-09-04T17:17:02.717Z",
  "executiveSummary": "Undici versions 8.10.0 through 8.10.2 are susceptible to a critical cross-origin information disclosure and cache poisoning vulnerability. The flaw originates from an improper implementation of cache and request-deduplication keys when interceptors are directly composed onto a Client or Pool instance. By failing to include the destination origin in the key generation logic, the internal mechanism defaults to an empty string, causing requests to be keyed solely on method, path, and headers. This allows an attacker to trigger collisions where a response intended for one origin is erroneously returned for a request targeting a different, trusted origin. The impact is severe, potentially resulting in full authentication bypasses, such as the unauthorized acceptance of attacker-controlled JWTs, and persistent poisoning of the cache. The vulnerability is limited to direct Client/Pool compositions; applications utilizing an Agent are unaffected as the dispatch options correctly propagate origin metadata. This defect represents a regression introduced in version 8.10.0, necessitating an immediate upgrade to version 8.10.2 to restore proper origin isolation.",
  "technicalDetails": "The vulnerability resides in the interceptor logic of the undici library, specifically concerning the generation of cache and deduplication keys. In versions 8.10.0 through 8.10.2, when a cache or deduplicate interceptor is initialized directly on a Client or Pool object, the key derivation function fails to incorporate the destination origin as a unique identifier. Consequently, the internal lookup table collapses requests from distinct origins into the same namespace, effectively treating them as synonymous if the request method, URI path, and headers match.\nThe root cause is a regression in the interceptor's context awareness during the dispatch flow. Because the origin is omitted, the cache key falls back to an empty origin string. This architectural oversight allows for a cache poisoning attack vector: an attacker can induce the library to store a response from a malicious or attacker-controlled source in the cache, keyed only by the common request parameters. When a legitimate client subsequently requests the same resource path from a trusted origin, the library matches the previously stored, attacker-influenced response, bypassing security checks and origin-specific context.\nThe exploitation flow proceeds as follows: 1) The attacker forces the system to perform a request to an attacker-controlled endpoint that mimics the path and header structure of a sensitive trusted resource. 2) The undici interceptor, lacking the origin in its key, stores the attacker's response (e.g., a forged JWT or malicious payload) in the deduplication or cache buffer under the shared key. 3) A legitimate application component initiates a request to the trusted origin. 4) The interceptor performs a lookup, finds the attacker-controlled entry due to the lack of origin-based partitioning, and serves the malicious payload as a legitimate response. This results in the client application processing untrusted data as authoritative, leading to authentication bypass or information leakage. This vulnerability is particularly dangerous because it does not require complex heap manipulation or memory corruption; it exploits the fundamental logic governing request isolation and cache integrity. Applications using an Agent are not vulnerable because the Agent architecture forces the inclusion of origin information within the dispatch options, effectively partitioning the cache keys as intended."
}