Availability Vulnerability in undici HTTP Client for Node.js by OpenJS Foundation

CVE-2026-120222

What is CVE-2026-120222?

The undici HTTP client for Node.js is vulnerable due to an issue with its cache interceptor. In specific versions, when combined with certain downstream handlers, if an error occurs during response processing, it can result in an uncaught exception or unhandled promise rejection. This situation can lead to a crash of the Node.js process whenever a cached response is replayed, potentially by a malicious server. To mitigate this, users are advised to upgrade to undici versions 7.30.2 and 8.12.4 or later. Until then, avoid using the cache interceptor with response handlers that can throw exceptions.

References