CVE-2026-109829

Name of the Vulnerable Software and Affected Versions undici versions 7.0.0 through 7.30.0 undici versions 8.0.0 through 8.12.1

Description An issue exists in this HTTP client library for Node.js when an originless Agent composes redirect and cache interceptors in that specific order while using a shared cache store. The cache generates its key from the original request URL before the redirect handler modifies the origin, causing responses from cross-origin redirects to be stored under the original key. This can lead to persistent cache poisoning if an attacker controls the redirect target of a trusted URL. Additionally, it may result in the disclosure of private data if a private redirect response to a user-specific resource is stored under the original URL and served to unauthenticated callers. This occurs only when an originless Agent, a shared cache store, and a redirect-then-cache composition are all utilized.

Recommendations Update versions 7.0.0 through 7.30.0 to 7.30.1 or later. Update versions 8.0.0 through 8.12.1 to 8.12.2 or later. Compose the cache interceptor before the redirect interceptor. Use per-origin dispatchers and cache stores. Disable shared caching on redirect-capable requests.