CVE-2026-120474

Name of the Vulnerable Software and Affected Versions undici versions 7.0.0 through 7.30.1 undici versions 8.0.0 through 8.12.3

Description When the redirect interceptor and a shared response cache are used together, an authenticated request redirected to a same-origin target stores the final response under the original request's cache key. Because this key omits credentials and lacks a Vary header, subsequent requests from anonymous or different users may be served the private response body of the first user, leading to cross-user disclosure of cached private responses.

Recommendations Upgrade versions 7.0.0 through 7.30.1 to 7.30.2 or later. Upgrade versions 8.0.0 through 8.12.3 to 8.12.4 or later.