CVE-2026-116630: medium-severity vulnerability in undici
undici vulnerable to cross-user information disclosure via cross-origin redirect revalidation
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
10Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.9
undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when an Agent composes the redirect and shared cache interceptors, a cached response that is revalidated with a conditional request can be validated by a 304 Not Modified from a different origin. When the origin that stored the response redirects the conditional revalidation request to another origin, the redirect handler strips origin-bound credential headers but not the cache-generated If-None-Match or If-Modified-Since validators, so the redirect destination receives the original origin's validator and undici treats its 304 as successful revalidation of the stored representation. As a result, a shared cache can serve the original origin's stored authenticated response, including one gated by Authorization, to a later unauthenticated caller. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, compose the interceptors as cache then redirect, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
undici · undiciRelated CVEs — undici
In the same product, most dangerous first.
CVE-2026-1526HIGHundici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate DecompressionEPSS 1.2%CVE-2026-2229HIGHundici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits ValidationEPSS 0.9%CVE-2026-12151HIGHundici WebSocket client vulnerable to denial of service via fragment count bypassEPSS 0.8%CVE-2026-2581MEDIUMundici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoSEPSS 0.6%CVE-2026-13697HIGHundici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directivesEPSS 0.6%CVE-2026-1525MEDIUMundici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')EPSS 0.5%