CVE-2026-85152

Name of the Vulnerable Software and Affected Versions undici versions 8.10.0 through 8.10.1

Description When the cache or deduplicate interceptor is composed directly onto a Client or Pool, the destination origin is omitted from the cache and request-deduplication keys. This causes the internal cache key to fall back to an empty origin string, allowing a response from one upstream origin to be returned for a request to a different trusted origin if the method, path, and relevant headers match. This leads to cross-origin information disclosure and persistent cache poisoning. A demonstrated impact includes a full authentication bypass where a JWT signed with an attacker-controlled key was accepted as belonging to a trusted issuer without the trusted origin being contacted.

Recommendations Upgrade to undici version 8.10.2.