HTTP Client Vulnerability in undici Affects Node.js Applications

CVE-2026-116592

What is CVE-2026-116592?

The undici HTTP client for Node.js has a vulnerability where it improperly manages cache entries during redirect operations. If a redirect occurs through an untrusted origin back to a trusted one, the cached response can still be associated with a trusted URL. This flaw permits an attacker controlling the redirect target to poison the cache, resulting in sensitive user-specific data potentially being served to unauthorized users. To mitigate this issue, users are advised to upgrade to undici versions 7.30.2 or 8.12.4 or later. Alternative methods include modifying the interceptor configuration and disabling shared caching for redirect-capable requests.

References