Nikolakojic-Rasit

**Name of the Vulnerable Software and Affected Versions** undici versions 8.10.0 through 8.10.1 **Description** When the cache or deduplicate interceptor is composed directly onto a Client or Pool, the destination origin is omitted from the cache and request-deduplication keys. This causes the internal cache key to fall back to an empty origin string, allowing a response from one upstream origin to be returned for a request to a different trusted origin if the method, path, and relevant headers match. This leads to cross-origin information disclosure and persistent cache poisoning. A demonstrated impact includes a full authentication bypass where a JWT signed with an attacker-controlled key was accepted as belonging to a trusted issuer without the trusted origin being contacted. **Recommendations** Upgrade to undici version 8.10.2.