CVE-2026-116630

Full vulnerability record from the local CVENow database.

Description

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when an Agent composes the redirect and shared cache interceptors, a cached response that is revalidated with a conditional request can be validated by a 304 Not Modified from a different origin. When the origin that stored the response redirects the conditional revalidation request to another origin, the redirect handler strips origin-bound credential headers but not the cache-generated If-None-Match or If-Modified-Since validators, so the redirect destination receives the original origin's validator and undici treats its 304 as successful revalidation of the stored representation. As a result, a shared cache can serve the original origin's stored authenticated response, including one gated by Authorization, to a later unauthenticated caller. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, compose the interceptors as cache then redirect, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.

Severity

MEDIUM

CVSS score

5.9 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

ce714d77-add3-4f53-aff5-83d477b104bb

Published

2026-11-06 11:17:05.497000

Last modified

2026-11-06 20:38:53.570000

View original CVE JSON

{
  "id": "CVE-2026-116630",
  "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb",
  "published": "2026-11-06T11:17:05.497",
  "lastModified": "2026-11-06T20:38:53.570",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when an Agent composes the redirect and shared cache interceptors, a cached response that is revalidated with a conditional request can be validated by a 304 Not Modified from a different origin. When the origin that stored the response redirects the conditional revalidation request to another origin, the redirect handler strips origin-bound credential headers but not the cache-generated If-None-Match or If-Modified-Since validators, so the redirect destination receives the original origin's validator and undici treats its 304 as successful revalidation of the stored representation. As a result, a shared cache can serve the original origin's stored authenticated response, including one gated by Authorization, to a later unauthenticated caller. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, compose the interceptors as cache then redirect, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests."
    }
  ],
  "affected": [
    {
      "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
      "affectedData": [
        {
          "vendor": "undici",
          "product": "undici",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/undici",
          "versions": [
            {
              "version": "7.0.0",
              "lessThan": "7.30.2",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "7.30.2",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "8.0.0",
              "lessThan": "8.12.4",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.12.4",
              "versionType": "semver",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6
      }
    ]
  },
  "weaknesses": [
    {
      "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        },
        {
          "lang": "en",
          "value": "CWE-524"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cna.openjsf.org/security-advisories.html",
      "source": "ce714d77-add3-4f53-aff5-83d477b104bb"
    },
    {
      "url": "https://github.com/nodejs/undici/security/advisories/GHSA-5rm8-gv32-r954",
      "source": "ce714d77-add3-4f53-aff5-83d477b104bb"
    }
  ]
}