{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/undici--7.30.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:nodejs:undici:*:*:*:*:*:*:*:*","cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-109829"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["undici (\u003c 7.30.1)","undici (\u003e= 8.0.0, \u003c 8.12.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Node.js"],"content_html":"\u003cp\u003eThe undici HTTP client library contains a vulnerability (CVE-2026-109829) in its cache interceptor when used in conjunction with the redirect interceptor. Specifically, when an originless Agent is configured with the interceptor composition \u003ccode\u003ecompose(redirect(), cache())\u003c/code\u003e and a shared cache, the cache key is generated based on the original request URL before the redirect occurs.\u003c/p\u003e\n\u003cp\u003eThis allows the response from a cross-origin redirect to be stored under the key of the initial trusted URL. An attacker controlling the redirect target can poison the cache with malicious content, or cause private, user-specific data to be stored and served to unauthenticated callers if the redirect path contains sensitive information. The vulnerability affects versions 7.x (\u0026lt; 7.30.1) and 8.x (\u0026lt; 8.12.2).\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for persistent cache poisoning of trusted URLs or the disclosure of sensitive, private data across users within the same shared cache instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003eundici\u003c/code\u003e to version \u003ccode\u003e7.30.1\u003c/code\u003e or \u003ccode\u003e8.12.2\u003c/code\u003e immediately.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately possible, update the interceptor composition order to \u003ccode\u003ecompose(cache(), redirect())\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eEnsure the use of per-origin dispatchers (\u003ccode\u003eClient\u003c/code\u003e or \u003ccode\u003ePool\u003c/code\u003e) or disable shared caching for requests that are susceptible to redirects.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T23:58:35Z","date_published":"2026-10-27T23:58:35Z","id":"https://feed.craftedsignal.io/briefs/2026-10-undici-cache-poisoning/","summary":"The undici library is vulnerable to cache poisoning and unauthorized cross-user data disclosure due to improper cache key generation when using shared cache interceptors after redirect handlers.","title":"undici: Cache poisoning and cross-user data disclosure via cross-origin redirects (CVE-2026-109829)","url":"https://feed.craftedsignal.io/briefs/2026-10-undici-cache-poisoning/"}],"language":"en","title":"CraftedSignal Threat Feed - Undici (\u003c 7.30.1)","version":"https://jsonfeed.org/version/1.1"}