---
id: "CVE-2026-116630"
page: "https://infrastack.ai/live/CVE-2026-116630"
kind: "vulnerability"
aliases: ["CVE-2026-116630"]
title: "undici: cache revalidation across redirects can serve authenticated responses to others"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["http-client", "node.js", "package", "shared-cache", "undici"]
not_affected_if: ["cache-then-redirect-order", "no-shared-caching", "per-origin-cache-stores"]
published_at: "2026-11-06T11:17:05+00:00"
first_seen_at: "2026-11-06T11:41:23+00:00"
updated_at: "2026-11-06T11:42:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116630", "first_seen_at": "2026-11-06T11:41:23+00:00"}]
exploit_sources: []
---

# undici: cache revalidation across redirects can serve authenticated responses to others

Link for people: https://infrastack.ai/live/CVE-2026-116630 (this .md is for agents)

undici, the HTTP client for Node.js, can treat a 304 Not Modified from a different origin as valid revalidation when a conditional request is redirected. A shared cache can then serve an original origin's stored authenticated response, including one gated by Authorization, to an unauthenticated caller.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the undici version in your project with `npm ls undici`, looking for `7.0.0` through `7.30.1` or `8.0.0` through `8.12.3`.
- Look for an Agent that composes the redirect and cache interceptors together, with a shared cache store across origins.

## Fix

- undici `7.30.2`
- undici `8.12.4`

## Timeline

- 2026-11-06T11:41:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116630

## Documents

- [advisory] Vendor advisory: github.com https://github.com/nodejs/undici/security/advisories/GHSA-5rm8-gv32-r954

## From the sources

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when an Agent composes the redirect and shared cache interceptors, a cached response that is revalidated with a conditional request can be validated by a 304 Not Modified from a different origin. When the origin that stored the response redirects the conditional revalidation request to another origin, the redirect handler strips origin-bound credential headers but not the cache-generated If-None-Match or If-Modified-Since validators, so the redirect destination receives the original origin's validator and undici treats its 304 as successful revalidation of the stored representation. As a result, a shared cache can serve the original origin's stored authenticated response, including one gated by Authorization, to a later unauthenticated caller. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, compose the interceptors as cache then redirect, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_