Cross-Origin Information Disclosure in undici by Node.js

CVE-2026-85152

What is CVE-2026-85152?

The undici library version 8.10.0 introduces a vulnerability due to the omission of the destination origin from cache and request-deduplication keys. This flaw allows cached responses from one trusted origin to be served inappropriately for requests to another origin, leading to potential cross-origin information disclosure and persistent cache poisoning. Notably, an authentication bypass was demonstrated, where a JSON Web Token (JWT) signed with an attacker-controlled key was incorrectly accepted as valid for a trusted issuer. The issue was introduced in version 8.10.0 and impacts all versions up to 8.10.2, except for those using an Agent that includes origin in dispatch options. A prompt upgrade to version 8.10.2 is highly recommended to mitigate the risk.

References