HTTP Client Library Vulnerability in Undici by Node.js

CVE-2026-109829

What is CVE-2026-109829?

Undici, an HTTP client library for Node.js, is susceptible to a cache poisoning vulnerability when using an originless Agent, a shared cache store, and a specific order of redirect and cache interceptors. This vulnerability allows attackers controlling a redirect target to cache responses under a trusted URL, which can mislead subsequent callers into receiving potentially malicious content. Additionally, sensitive data from user-specific resources can be inadvertently exposed to unauthenticated requests, heightening security concerns for applications leveraging this library. The issue has been addressed in versions 7.30.1 and 8.12.2, where enhancements ensure cache keys reflect the correct origin post-redirect and respect cache-control policies throughout redirect sequences.

References