CVE-2026-120222 · Package
NO FIX YET · SEE WHAT TO DO
undici, the HTTP client library for Node.js, crashes the whole process when the cache interceptor is combined with a handler that throws during response processing and a cached response is replayed. A malicious or compromised HTTP server can trigger this by serving a cacheable response, causing a denial of service with no code execution.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that use undici's cache interceptor composed with the dump interceptor (with maxSize) or the decompress interceptor, and that fetch from servers that may be malicious or compromised, are exposed. A process crash is the impact; the sources do not describe data access. Projects that do not use the cache interceptor or do not compose it with those handlers can skip it.
Not affected if default-config, no-cache-interceptor
Who cares node.js, npm, undici
npm ls undici in the project.7.30.2 for the 7.x line.8.12.4 for the 8.x line.undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the cache interceptor is composed with a downstream handler that throws during response processing (such as the built-in dump interceptor exceeding its maxSize, or the decompress interceptor rejecting more than five Content-Encoding values), a throw raised asynchronously while a cached response is replayed escapes as an uncaught exception or unhandled promise rejection and terminates the Node.js process. A malicious or compromised HTTP server can crash any such client by serving a cacheable response that triggers the throw on replay, including on a 304 revalidation of a stale entry, so the impact is availability only. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, avoid composing the cache interceptor with a response handler that throws during response processing until upgrading.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.