undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

影響: npm:undici >= 7.0.0, < 7.30.1 → 7.30.1, npm:undici >= 8.0.0, < 8.12.2 → 8.12.2

When an originless Agent composes the redirect and cache interceptors as compose(redirect(), cache()) with a shared cache (type: 'shared'), the cache builds its key from the original request URL before the redirect handler changes the origin. The response produced after a redirect is then stored under the original key, even when the redirect crossed to a different origin. An attacker who controls the target of a redirect from a trusted URL can have their response cached under that trusted URL.…

GitHub Advisory Databaseで読む

2026/10/28 04:02、GitHub Advisory Databaseが「undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: JavaScript / Node.js。CVE: CVE-2026-109829。