CVE-2026-120222

Name of the Vulnerable Software and Affected Versions undici versions 7.0.0 through 7.30.1 undici versions 8.0.0 through 8.12.3

Description An issue exists in the HTTP client where the cache interceptor, when used with a downstream handler that throws during response processing, allows an asynchronous throw to escape as an uncaught exception or unhandled promise rejection. This occurs during the replay of a cached response, which terminates the Node.js process. A malicious or compromised HTTP server can trigger this by serving a cacheable response that causes a throw on replay, such as during a 304 revalidation of a stale entry, impacting system availability. Examples of handlers that may trigger this include the dump interceptor exceeding its maxSize or the decompress interceptor rejecting more than five Content-Encoding values.

Recommendations Update versions 7.0.0 through 7.30.1 to 7.30.2 or later. Update versions 8.0.0 through 8.12.3 to 8.12.4 or later. As a temporary workaround, avoid composing the cache interceptor with a response handler that throws during response processing.