{"id":"ghsa-ghsa-4w7w-5xrc-9h26","seq":1708760,"kind":"advisory","title":"undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects","url":"https://github.com/advisories/GHSA-4w7w-5xrc-9h26","permalink":"https://vulnpulse.app/items/ghsa-ghsa-4w7w-5xrc-9h26","summary":"影響: npm:undici >= 7.0.0, < 7.30.1 → 7.30.1, npm:undici >= 8.0.0, < 8.12.2 → 8.12.2\nWhen an originless Agent composes the redirect and cache interceptors as compose(redirect(), cache()) with a shared cache (type: 'shared'), the cache builds its key from the original request URL before the redirect handler changes the origin. The response produced after a redirect is then stored under the original key, even when the redirect crossed to a different origin. An attacker who controls the target of a redirect from a trusted URL can have their response cached under that trusted URL.…","severity":"high","techs":["nodejs"],"cves":["CVE-2026-109829"],"tags":["GHSA-4w7w-5xrc-9h26","undici","undici"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T19:02:31.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}