---
id: "CVE-2026-120474"
page: "https://infrastack.ai/live/CVE-2026-120474"
kind: "vulnerability"
aliases: ["CVE-2026-120474"]
title: "undici: redirected authenticated responses cached under a shared key"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["node.js", "npm", "package", "undici"]
not_affected_if: ["no-redirect-interceptor", "no-shared-cache", "versions-outside-range"]
published_at: "2026-11-06T10:16:36+00:00"
first_seen_at: "2026-11-06T10:40:56+00:00"
updated_at: "2026-11-06T10:41:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120474", "first_seen_at": "2026-11-06T10:40:56+00:00"}]
exploit_sources: []
---

# undici: redirected authenticated responses cached under a shared key

Link for people: https://infrastack.ai/live/CVE-2026-120474 (this .md is for agents)

undici, the HTTP client behind Node.js fetch, can store the final response of an authenticated redirect under the original request's cache key when the redirect interceptor and a shared response cache are used together. A later anonymous or different user can then be served the first user's private response body.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed undici version with `npm ls undici` in the project and in any dependency that bundles it.
- Look for use of the redirect interceptor together with a shared cache interceptor in the HTTP client setup.

## Fix

- undici `7.30.2` for the 7.x line
- undici `8.12.4` for the 8.x line

## Timeline

- 2026-11-06T10:40:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120474

## Documents

- [advisory] Vendor advisory: github.com https://github.com/nodejs/undici/security/advisories/GHSA-7xg3-fphp-28hg

## From the sources

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the redirect interceptor and a shared response cache are used together, an authenticated request that is redirected to a same-origin target has the final response stored under the original request's cache key. That key omits the credential and carries no Vary header, so a later anonymous or different user can be served the first user's private response body. This results in cross-user disclosure of cached private responses. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_