CVE-2026-120222
Full vulnerability record from the local CVENow database.
Description
undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the cache interceptor is composed with a downstream handler that throws during response processing (such as the built-in dump interceptor exceeding its maxSize, or the decompress interceptor rejecting more than five Content-Encoding values), a throw raised asynchronously while a cached response is replayed escapes as an uncaught exception or unhandled promise rejection and terminates the Node.js process. A malicious or compromised HTTP server can crash any such client by serving a cacheable response that triggers the throw on replay, including on a 304 revalidation of a stale entry, so the impact is availability only. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, avoid composing the cache interceptor with a response handler that throws during response processing until upgrading.
View original CVE JSON
{
"id": "CVE-2026-120222",
"sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb",
"published": "2026-11-06T10:16:36.497",
"lastModified": "2026-11-06T10:16:36.497",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the cache interceptor is composed with a downstream handler that throws during response processing (such as the built-in dump interceptor exceeding its maxSize, or the decompress interceptor rejecting more than five Content-Encoding values), a throw raised asynchronously while a cached response is replayed escapes as an uncaught exception or unhandled promise rejection and terminates the Node.js process. A malicious or compromised HTTP server can crash any such client by serving a cacheable response that triggers the throw on replay, including on a 304 revalidation of a stale entry, so the impact is availability only. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, avoid composing the cache interceptor with a response handler that throws during response processing until upgrading."
}
],
"affected": [
{
"source": "ce714d77-add3-4f53-aff5-83d477b104bb",
"affectedData": [
{
"vendor": "undici",
"product": "undici",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/undici",
"versions": [
{
"version": "7.0.0",
"lessThan": "7.30.2",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.30.2",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "8.0.0",
"lessThan": "8.12.4",
"versionType": "semver",
"status": "affected"
},
{
"version": "8.12.4",
"versionType": "semver",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "ce714d77-add3-4f53-aff5-83d477b104bb",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "ce714d77-add3-4f53-aff5-83d477b104bb",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-248"
},
{
"lang": "en",
"value": "CWE-755"
}
]
}
],
"references": [
{
"url": "https://cna.openjsf.org/security-advisories.html",
"source": "ce714d77-add3-4f53-aff5-83d477b104bb"
},
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-3g9m-rv3r-w5w2",
"source": "ce714d77-add3-4f53-aff5-83d477b104bb"
}
]
}