CVE-2026-116592

Name of the Vulnerable Software and Affected Versions undici version 7.30.1 undici versions 8.12.2 through 8.12.3

Description When an originless Agent composes redirect and shared cache interceptors, the system determines whether to store the final response under the original request key by inspecting only the final redirect hop. This allows a redirect that passes through an untrusted origin and returns to a trusted origin to be cached under the trusted key. Consequently, the Vary header of an intermediate hop may be dropped, potentially serving responses that vary on Authorization or Cookie to different users. Additionally, the no-cache or default-uncacheable status of an intermediate hop may be ignored, allowing a non-storable redirect to be treated as a cacheable entry. An attacker controlling a redirect target from a trusted URL could poison the cached entry or cause a private, per-user response to be served to subsequent callers.

Recommendations Update version 7.30.1 to 7.30.2 or later. Update versions 8.12.2 through 8.12.3 to 8.12.4 or later. Compose the interceptors as cache then redirect. Use per-origin dispatchers and cache stores. Disable shared caching on redirect-capable requests.