HTTP Client Vulnerability in Undici for Node.js

CVE-2026-116630

What is CVE-2026-116630?

A flaw in the Undici HTTP client for Node.js allows for the possibility of serving authenticated responses to unauthenticated users due to improper handling of cache validation during redirect processes. The vulnerability arises when a cached response, validated by a conditional request, inadvertently accepts a 304 Not Modified response from different origins. This mishandling can lead to sensitive information being accessible to users without proper authorization. To mitigate this issue, users are advised to upgrade to Undici versions 7.30.2 and 8.12.4 or later and to consider modifying cache and redirect interceptor configurations.

References