{"id":"CVE-2026-116630","kind":"vulnerability","aliases":["CVE-2026-116630"],"related":[],"title":"undici: cache revalidation across redirects can serve authenticated responses to others","description":"undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when an Agent composes the redirect and shared cache interceptors, a cached response that is revalidated with a conditional request can be validated by a 304 Not Modified from a different origin. When the origin that stored the response redirects the conditional revalidation request to another origin, the redirect handler strips origin-bound credential headers but not the cache-generated If-None-Match or If-Modified-Since validators, so the redirect destination receives the original origin's validator and undici treats its 304 as successful revalidation of the stored representation. As a result, a shared cache can serve the original origin's stored authenticated response, including one gated by Authorization, to a later unauthenticated caller. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, compose the interceptors as cache then redirect, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.","summary":"undici, the HTTP client for Node.js, can treat a 304 Not Modified from a different origin as valid revalidation when a conditional request is redirected. A shared cache can then serve an original origin's stored authenticated response, including one gated by Authorization, to an unauthenticated caller.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["http-client","node.js","package","shared-cache","undici"],"not_affected_if":["cache-then-redirect-order","no-shared-caching","per-origin-cache-stores"],"how_to_check":"- Check the undici version in your project with `npm ls undici`, looking for `7.0.0` through `7.30.1` or `8.0.0` through `8.12.3`.\n- Look for an Agent that composes the redirect and cache interceptors together, with a shared cache store across origins.","fix":"- undici `7.30.2`\n- undici `8.12.4`","status":"open","published_at":"2026-11-06T11:17:05+00:00","first_seen_at":"2026-11-06T11:41:23+00:00","triaged_at":"2026-11-06T11:42:26+00:00","updated_at":"2026-11-06T11:42:26+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T11:42:26Z","model":"claude-haiku-5-5","output":{"fix":"- undici `7.30.2`\n- undici `8.12.4`","reach":"network","title":"undici: cache revalidation across redirects can serve authenticated responses to others","impact":"medium","summary":"undici, the HTTP client for Node.js, can treat a 304 Not Modified from a different origin as valid revalidation when a conditional request is redirected. A shared cache can then serve an original origin's stored authenticated response, including one gated by Authorization, to an unauthenticated caller.","audience":"developers","category":"package","nicknames":[],"who_cares":["undici","node.js","http-client","shared-cache"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"unauthenticated callers read cached authenticated responses from other origins","analyst_note":"","how_to_check":"- Check the undici version in your project with `npm ls undici`, looking for `7.0.0` through `7.30.1` or `8.0.0` through `8.12.3`.\n- Look for an Agent that composes the redirect and cache interceptors together, with a shared cache store across origins.","plain_action":"","needs_analyst":false,"not_affected_if":["per-origin-cache-stores","cache-then-redirect-order","no-shared-caching"],"who_is_affected":"Only applications that use undici's Agent with both the redirect and shared cache interceptors composed, and where a cache store is shared across origins and requests can be redirected. Per-origin dispatchers or per-origin cache stores, or applications without shared caching on redirect-capable requests, are less exposed. Other undici setups are unknown from these sources.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000742,"input_tokens":4473,"output_tokens":589,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116630':14A,17A '-2026':13A,16A '304':36B,115C,176C '7.0.0':83C '7.30.1':85C '7.30.2':215C '8.0.0':87C '8.12.3':89C '8.12.4':217C 'across':4A 'agent':92C 'anoth':135C 'authent':8A,63B,197C 'author':69B,203C 'bound':143C 'cach':2A,25B,54B,98C,101C,150C,189C,236C,245C,250C 'cache-gener':149C 'caller':73B,208C 'capabl':254C 'client':20B,30B,78C 'compos':93C,232C 'condit':48B,108C,131C 'credenti':144C 'cve':12A,15A 'destin':165C 'differ':41B,120C 'disabl':248C 'dispatch':243C 'fix':212C 'gate':67B,201C 'generat':151C 'handler':139C 'header':145C 'http':19B,29B,77C 'http-client':18B 'if-modified-sinc':157C 'if-none-match':152C 'includ':65B,199C 'interceptor':99C,234C 'issu':210C 'later':206C,228C 'match':155C 'modifi':38B,117C,159C 'node.js':21B,32B,80C 'none':154C 'one':66B,200C,223C 'origin':42B,59B,60B,121C,124C,136C,142C,168C,169C,193C,194C,242C 'origin-bound':141C 'other':11A 'packag':22B 'per':241C 'per-origin':240C 'receiv':166C 'redirect':5A,51B,95C,129C,138C,164C,238C,253C 'redirect-cap':252C 'represent':183C 'request':49B,109C,133C,255C 'respons':9A,64B,102C,128C,198C 'result':186C 'revalid':3A,45B,105C,132C,179C 'serv':7A,57B,191C 'share':24B,53B,97C,188C,249C 'shared-cach':23B 'sinc':160C 'store':62B,126C,182C,196C,246C 'strip':140C 'success':178C 'treat':34B,174C 'unauthent':72B,207C 'undici':1A,26B,27B,74C,173C,214C 'upgrad':221C 'use':239C 'user':219C 'valid':44B,112C,161C,171C 'version':82C,226C 'workaround':231C","nicknames":[],"mitigations":[],"who_affected":"Only applications that use undici's Agent with both the redirect and shared cache interceptors composed, and where a cache store is shared across origins and requests can be redirected. Per-origin dispatchers or per-origin cache stores, or applications without shared caching on redirect-capable requests, are less exposed. Other undici setups are unknown from these sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["httpclient","medium","nodejs","package","sharedcache","undici"],"campaign_type":null,"search_a":"'-116630':14A,17A '-2026':13A,16A 'across':4A 'authent':8A 'cach':2A 'cve':12A,15A 'other':11A 'redirect':5A 'respons':9A 'revalid':3A 'serv':7A 'undici':1A","search_b":"'304':36B 'authent':63B 'author':69B 'cach':25B,54B 'caller':73B 'client':20B,30B 'condit':48B 'differ':41B 'gate':67B 'http':19B,29B 'http-client':18B 'includ':65B 'modifi':38B 'node.js':21B,32B 'one':66B 'origin':42B,59B,60B 'packag':22B 'redirect':51B 'request':49B 'respons':64B 'revalid':45B 'serv':57B 'share':24B,53B 'shared-cach':23B 'store':62B 'treat':34B 'unauthent':72B 'undici':26B,27B 'valid':44B","search_c":"'304':115C,176C '7.0.0':83C '7.30.1':85C '7.30.2':215C '8.0.0':87C '8.12.3':89C '8.12.4':217C 'agent':92C 'anoth':135C 'authent':197C 'author':203C 'bound':143C 'cach':98C,101C,150C,189C,236C,245C,250C 'cache-gener':149C 'caller':208C 'capabl':254C 'client':78C 'compos':93C,232C 'condit':108C,131C 'credenti':144C 'destin':165C 'differ':120C 'disabl':248C 'dispatch':243C 'fix':212C 'gate':201C 'generat':151C 'handler':139C 'header':145C 'http':77C 'if-modified-sinc':157C 'if-none-match':152C 'includ':199C 'interceptor':99C,234C 'issu':210C 'later':206C,228C 'match':155C 'modifi':117C,159C 'node.js':80C 'none':154C 'one':200C,223C 'origin':121C,124C,136C,142C,168C,169C,193C,194C,242C 'origin-bound':141C 'per':241C 'per-origin':240C 'receiv':166C 'redirect':95C,129C,138C,164C,238C,253C 'redirect-cap':252C 'represent':183C 'request':109C,133C,255C 'respons':102C,128C,198C 'result':186C 'revalid':105C,132C,179C 'serv':191C 'share':97C,188C,249C 'sinc':160C 'store':126C,182C,196C,246C 'strip':140C 'success':178C 'treat':174C 'unauthent':207C 'undici':74C,173C,214C 'upgrad':221C 'use':239C 'user':219C 'valid':112C,161C,171C 'version':82C,226C 'workaround':231C","first_public_at":"2026-11-05T10:28:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"ce714d77-add3-4f53-aff5-83d477b104bb","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116630","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116630","severity":null,"published_at":"2026-11-06T11:17:05+00:00","modified_at":"2026-11-06T11:17:05+00:00","first_seen_at":"2026-11-06T11:41:23+00:00","fetched_at":"2026-11-06T11:41:23+00:00","note":null}],"documents":[{"id":85883,"url":"https://github.com/nodejs/undici/security/advisories/GHSA-5rm8-gv32-r954","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-05T10:28:24+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}