undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

影響: npm:undici >= 7.0.0, < 7.30.1 → 7.30.1, npm:undici >= 8.0.0, < 8.12.2 → 8.12.2

When an originless Agent composes the redirect and cache interceptors as compose(redirect(), cache()) with a shared cache (type: 'shared'), the cache builds its key from the original request URL before the redirect handler changes the origin. The response produced after a redirect is then stored under the original key, even when the redirect crossed to a different origin. An attacker who controls the target of a redirect from a trusted URL can have their response cached under that trusted URL.…

在 GitHub Advisory Database 阅读

2026/10/28 04:02，GitHub Advisory Database 发布了“undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：JavaScript / Node.js。CVE：CVE-2026-109829。