Cpe:2.3:a:nodejs:undici:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3anodejsundici/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 23:58:35 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgundici: Cache poisoning and cross-user data disclosure via cross-origin redirects (CVE-2026-109829)https://feed.craftedsignal.io/briefs/2026-10-undici-cache-poisoning/Tue, 27 Oct 2026 23:58:35 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-undici-cache-poisoning/The undici library is vulnerable to cache poisoning and unauthorized cross-user data disclosure due to improper cache key generation when using shared cache interceptors after redirect handlers.The undici HTTP client library contains a vulnerability (CVE-2026-109829) in its cache interceptor when used in conjunction with the redirect interceptor. Specifically, when an originless Agent is configured with the interceptor composition compose(redirect(), cache()) and a shared cache, the cache key is generated based on the original request URL before the redirect occurs.

This allows the response from a cross-origin redirect to be stored under the key of the initial trusted URL. An attacker controlling the redirect target can poison the cache with malicious content, or cause private, user-specific data to be stored and served to unauthenticated callers if the redirect path contains sensitive information. The vulnerability affects versions 7.x (< 7.30.1) and 8.x (< 8.12.2).

Impact

Successful exploitation allows for persistent cache poisoning of trusted URLs or the disclosure of sensitive, private data across users within the same shared cache instance.

Recommendation

  • Upgrade undici to version 7.30.1 or 8.12.2 immediately.
  • If upgrading is not immediately possible, update the interceptor composition order to compose(cache(), redirect()).
  • Ensure the use of per-origin dispatchers (Client or Pool) or disable shared caching for requests that are susceptible to redirects.
]]>highadvisory