CVE-2026-120474 · Package
NO FIX YET · SEE WHAT TO DO
undici, the HTTP client behind Node.js fetch, can store the final response of an authenticated redirect under the original request's cache key when the redirect interceptor and a shared response cache are used together. A later anonymous or different user can then be served the first user's private response body.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that use undici's redirect interceptor and a shared response cache together, where authenticated requests can be redirected to a same-origin target. Clients that do not combine these features, or that do not cache responses across users, are not exposed by this description.
Not affected if no-redirect-interceptor, no-shared-cache, versions-outside-range
Who cares node.js, npm, undici
npm ls undici in the project and in any dependency that bundles it.7.30.2 for the 7.x line8.12.4 for the 8.x lineundici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the redirect interceptor and a shared response cache are used together, an authenticated request that is redirected to a same-origin target has the final response stored under the original request's cache key. That key omits the credential and carries no Vary header, so a later anonymous or different user can be served the first user's private response body. This results in cross-user disclosure of cached private responses. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.