CVE-2026-109829
Received Received - Intake

Cache Poisoning in Undici HTTP Client

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: openjs

Description
undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handler changes the origin, so a response produced after a cross-origin redirect is stored under the original key. An attacker who controls the target of a redirect from a trusted URL can have their response cached under that trusted URL and served to later callers, allowing persistent cache poisoning, and the same key confusion lets a private, non-stored redirect response to a user-specific resource be stored under the original URL and served to a later unauthenticated caller, disclosing private data. Applications are affected only when an originless Agent, a shared cache store, and the redirect-then-cache composition are all used. The issue is fixed in undici 7.30.1 and 8.12.2, which verify the producing origin still matches the cache key and preserve each redirect hop's cache-control policy before storing, and users should upgrade to one of those versions or later. As a workaround, compose the cache interceptor before the redirect interceptor, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-16
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-109829
EUVD
EUVD-2026-102309

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
undici undici 7.0.0
undici undici 8.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-346 The product does not properly verify that the source of data or communication is valid.
CWE-524 The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the undici library for Node.js allows cache poisoning and cross-user data disclosure when cross-origin redirects are mishandled. It occurs when the cache key is generated from the original request URL before a redirect changes the origin, causing responses from redirected origins to be stored under the original URL.

Detection Guidance

To detect this vulnerability, check if your application uses undici versions 7.0.0 through 7.30.0 or 8.0.0 through 8.12.1 with an originless Agent, shared cache store, and redirect interceptor composed after cache interceptor. Inspect interceptor composition in code and verify undici version with commands like npm list undici or node -e "console.log(require('undici/package.json').version)"

Check cache storage for unexpected responses under trusted URLs or user-specific resources. Monitor for cache poisoning symptoms like cached malicious content or unauthorized data exposure.

Impact Analysis

Attackers can poison the cache by controlling the redirect target, serving malicious content to users requesting the original URL. Additionally, private data from authenticated requests may be exposed to unauthenticated users via the cache.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, potentially violating GDPR's data protection principles and HIPAA's confidentiality requirements, as sensitive user data may be disclosed to unauthorized parties.

Mitigation Strategies

Upgrade undici to version 7.30.1 or 8.12.2 or later. If upgrading is not possible, reorder interceptors to compose(cache(), redirect()) or use per-origin dispatchers and cache stores. Disable shared caching for redirect-capable requests as a temporary measure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109829. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart