{"id":"CVE-2026-120474","kind":"vulnerability","aliases":["CVE-2026-120474"],"related":[],"title":"undici: redirected authenticated responses cached under a shared key","description":"undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the redirect interceptor and a shared response cache are used together, an authenticated request that is redirected to a same-origin target has the final response stored under the original request's cache key. That key omits the credential and carries no Vary header, so a later anonymous or different user can be served the first user's private response body. This results in cross-user disclosure of cached private responses. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later.","summary":"undici, the HTTP client behind Node.js fetch, can store the final response of an authenticated redirect under the original request's cache key when the redirect interceptor and a shared response cache are used together. A later anonymous or different user can then be served the first user's private response body.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["node.js","npm","package","undici"],"not_affected_if":["no-redirect-interceptor","no-shared-cache","versions-outside-range"],"how_to_check":"- Check the installed undici version with `npm ls undici` in the project and in any dependency that bundles it.\n- Look for use of the redirect interceptor together with a shared cache interceptor in the HTTP client setup.","fix":"- undici `7.30.2` for the 7.x line\n- undici `8.12.4` for the 8.x line","status":"open","published_at":"2026-11-06T10:16:36+00:00","first_seen_at":"2026-11-06T10:40:56+00:00","triaged_at":"2026-11-06T10:41:16+00:00","updated_at":"2026-11-06T10:41:16+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T10:41:16Z","model":"claude-haiku-5-5","output":{"fix":"- undici `7.30.2` for the 7.x line\n- undici `8.12.4` for the 8.x line","reach":"network","title":"undici: redirected authenticated responses cached under a shared key","impact":"medium","summary":"undici, the HTTP client behind Node.js fetch, can store the final response of an authenticated redirect under the original request's cache key when the redirect interceptor and a shared response cache are used together. A later anonymous or different user can then be served the first user's private response body.","audience":"developers","category":"package","nicknames":[],"who_cares":["node.js","undici","npm"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"one user's private cached response body is served to another user","analyst_note":"","how_to_check":"- Check the installed undici version with `npm ls undici` in the project and in any dependency that bundles it.\n- Look for use of the redirect interceptor together with a shared cache interceptor in the HTTP client setup.","plain_action":"","needs_analyst":false,"not_affected_if":["no-shared-cache","no-redirect-interceptor","versions-outside-range"],"who_is_affected":"Applications that use undici's redirect interceptor and a shared response cache together, where authenticated requests can be redirected to a same-origin target. Clients that do not combine these features, or that do not cache responses across users, are not exposed by this description.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000687,"input_tokens":4315,"output_tokens":511,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120474':12A,15A '-2026':11A,14A '7.0.0':81C '7.30.1':83C '7.30.2':168C '8.0.0':85C '8.12.3':87C '8.12.4':170C 'anonym':57B,137C 'authent':3A,34B,101C 'behind':24B 'bodi':71B,150C 'cach':5A,41B,51B,96C,122C,159C 'carri':130C 'client':23B,76C 'credenti':128C 'cross':155C 'cross-us':154C 'cve':10A,13A 'differ':59B,139C 'disclosur':157C 'fetch':26B 'final':30B,114C 'first':66B,145C 'fix':165C 'header':133C 'http':22B,75C 'interceptor':46B,91C 'issu':163C 'key':9A,42B,123C,125C 'later':56B,136C,181C 'node.js':16B,25B,78C 'npm':17B 'omit':126C 'one':176C 'origin':38B,110C,119C 'packag':18B 'privat':69B,148C,160C 'redirect':2A,35B,45B,90C,105C 'request':39B,102C,120C 'respons':4A,31B,50B,70B,95C,115C,149C,161C 'result':152C 'same-origin':108C 'serv':64B,143C 'share':8A,49B,94C 'store':28B,116C 'target':111C 'togeth':54B,99C 'undici':1A,19B,20B,72C,167C 'upgrad':174C 'use':53B,98C 'user':60B,67B,140C,146C,156C,172C 'vari':132C 'version':80C,179C","nicknames":[],"mitigations":[],"who_affected":"Applications that use undici's redirect interceptor and a shared response cache together, where authenticated requests can be redirected to a same-origin target. Clients that do not combine these features, or that do not cache responses across users, are not exposed by this description.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","nodejs","npm","package","undici"],"campaign_type":null,"search_a":"'-120474':12A,15A '-2026':11A,14A 'authent':3A 'cach':5A 'cve':10A,13A 'key':9A 'redirect':2A 'respons':4A 'share':8A 'undici':1A","search_b":"'anonym':57B 'authent':34B 'behind':24B 'bodi':71B 'cach':41B,51B 'client':23B 'differ':59B 'fetch':26B 'final':30B 'first':66B 'http':22B 'interceptor':46B 'key':42B 'later':56B 'node.js':16B,25B 'npm':17B 'origin':38B 'packag':18B 'privat':69B 'redirect':35B,45B 'request':39B 'respons':31B,50B,70B 'serv':64B 'share':49B 'store':28B 'togeth':54B 'undici':19B,20B 'use':53B 'user':60B,67B","search_c":"'7.0.0':81C '7.30.1':83C '7.30.2':168C '8.0.0':85C '8.12.3':87C '8.12.4':170C 'anonym':137C 'authent':101C 'bodi':150C 'cach':96C,122C,159C 'carri':130C 'client':76C 'credenti':128C 'cross':155C 'cross-us':154C 'differ':139C 'disclosur':157C 'final':114C 'first':145C 'fix':165C 'header':133C 'http':75C 'interceptor':91C 'issu':163C 'key':123C,125C 'later':136C,181C 'node.js':78C 'omit':126C 'one':176C 'origin':110C,119C 'privat':148C,160C 'redirect':90C,105C 'request':102C,120C 'respons':95C,115C,149C,161C 'result':152C 'same-origin':108C 'serv':143C 'share':94C 'store':116C 'target':111C 'togeth':99C 'undici':72C,167C 'upgrad':174C 'use':98C 'user':140C,146C,156C,172C 'vari':132C 'version':80C,179C","first_public_at":"2026-11-05T10:25:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","cvss_by":"ce714d77-add3-4f53-aff5-83d477b104bb","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120474","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120474","severity":null,"published_at":"2026-11-06T10:16:36+00:00","modified_at":"2026-11-06T10:16:36+00:00","first_seen_at":"2026-11-06T10:40:56+00:00","fetched_at":"2026-11-06T10:40:56+00:00","note":null}],"documents":[{"id":85514,"url":"https://github.com/nodejs/undici/security/advisories/GHSA-7xg3-fphp-28hg","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-05T10:25:43+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}