Cross-User Disclosure in HTTP Client for Node.js

CVE-2026-120474

What is CVE-2026-120474?

The undici HTTP client for Node.js has a vulnerability affecting versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3. When using the redirect interceptor along with a shared response cache, the final response to an authenticated request redirected to a same-origin target is stored under the original request’s cache key. This key neglects to include credentials and does not have a Vary header, enabling future anonymous or different users to access previously cached private responses. Users are advised to upgrade to versions 7.30.2 or 8.12.4 or later to mitigate this issue.

References