CVE-2026-116630

Name of the Vulnerable Software and Affected Versions undici versions 7.0.0 through 7.30.1 undici versions 8.0.0 through 8.12.3

Description When an Agent composes redirect and shared cache interceptors, a cached response revalidated with a conditional request may be incorrectly validated by a 304 Not Modified response from a different origin. This occurs because the redirect handler removes origin-bound credential headers but fails to remove cache-generated If-None-Match or If-Modified-Since validators. Consequently, the redirect destination receives the original origin's validator, and the system treats the 304 response as a successful revalidation. This can lead to a shared cache serving an authenticated response, such as one protected by an Authorization header, to an unauthenticated caller.

Recommendations Update versions 7.0.0 through 7.30.1 to 7.30.2 or later. Update versions 8.0.0 through 8.12.3 to 8.12.4 or later. Compose interceptors as cache then redirect. Use per-origin dispatchers and cache stores. Disable shared caching on redirect-capable requests.