undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

影響: npm:undici >= 7.0.0, < 7.30.1 → 7.30.1, npm:undici >= 8.0.0, < 8.12.2 → 8.12.2

When an originless Agent composes the redirect and cache interceptors as compose(redirect(), cache()) with a shared cache (type: 'shared'), the cache builds its key from the original request URL before the redirect handler changes the origin. The response produced after a redirect is then stored under the original key, even when the redirect crossed to a different origin. An attacker who controls the target of a redirect from a trusted URL can have their response cached under that trusted URL.…

Read on GitHub Advisory Database

On 10/28/2026, 04:02 AM, GitHub Advisory Database published "undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects" (type: Advisory). Severity is "High" (high). Related technologies: JavaScript / Node.js. CVE: CVE-2026-109829.