CVE-2026-85152 in Undici
Summary
by MITRE • 09/04/2026
undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream origin is returned for a request to a different, trusted origin whenever the method, path, and relevant headers match, which permits cross-origin information disclosure and persistent cache poisoning. The reporter demonstrated a full authentication bypass in which a JWT signed with an attacker-controlled key was accepted as belonging to a trusted issuer, and the trusted origin was never contacted. This is a regression introduced in 8.10.0 and affects undici versions from 8.10.0 up to 8.10.2. Applications using an Agent, which carries the origin in its dispatch options, are not affected. Users should upgrade to undici 8.10.2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in undici versions ranging from 8.10.0 through 8.10.2 represents a critical regression in how HTTP client interceptors manage caching and request deduplication logic when composed directly onto Client or Pool instances. This flaw stems from the omission of the destination origin within the internal keys used for both the cache storage mechanism and the active request deduplication process. In standard HTTP client operations, particularly those involving security-sensitive contexts such as authentication tokens or session management, it is imperative that requests are uniquely identified not only by their method, path, and headers but also by their target origin to prevent cross-origin data leakage. The internal implementation failed to include the origin string in these keys, causing them to default to an empty value when specific interceptor configurations were applied directly rather than through higher-level abstractions like Agent objects which correctly propagate this context.
This technical deficiency leads to a severe operational impact characterized by cross-origin information disclosure and persistent cache poisoning. When two distinct requests are made to different upstream origins but share identical methods, paths, and relevant headers, the flawed key generation logic treats them as equivalent. Consequently, if an in-flight response or a cached entry exists for one origin, it may be erroneously returned to satisfy a request directed at a completely different trusted origin. This behavior violates fundamental security principles regarding isolation of network resources based on origin boundaries. An attacker exploiting this condition can manipulate the client into accepting responses intended for other domains, thereby bypassing expected access controls and potentially exposing sensitive data that should remain confined to its original context.
The severity of this vulnerability is further amplified by its potential to facilitate authentication bypasses through cache poisoning techniques. In demonstrated scenarios involving JSON Web Tokens (JWTs), an attacker was able to leverage the misconfigured caching mechanism to serve a JWT signed with an attacker-controlled key as if it were issued by a trusted authority. Because the client incorrectly associated the cached response from one origin with requests to another, the application accepted the malicious token without ever contacting the legitimate authentication server of the target origin. This effectively neutralizes integrity checks and allows unauthorized access to protected resources, representing a classic instance where improper state management leads to complete compromise of identity verification mechanisms.
From an industry standards perspective, this vulnerability aligns with CWE-200: Information Exposure and CWE-798: Use of Hard-coded Credentials if the cached token is reused across contexts without validation. It also maps closely to MITRE ATT&CK technique T1534: Internal Spearphishing in broader social engineering contexts, but more accurately reflects technical exploitation patterns found under T1078: Valid Accounts when considering the unauthorized use of valid tokens derived from cross-origin leakage. The flaw essentially creates a side-channel through which an attacker can hijack legitimate session states or authentication artifacts by exploiting the lack of origin-based isolation in the HTTP client's internal data structures.
Mitigation for this issue requires immediate action to upgrade undici to version 8.10.2, where the regression has been corrected and the destination origin is properly included in cache and deduplication keys. For applications that cannot immediately update their dependencies due to compatibility constraints or other operational reasons, a viable workaround involves ensuring that HTTP clients are instantiated using an Agent object rather than composing interceptors directly onto Client or Pool instances. The Agent abstraction correctly carries the origin information within its dispatch options, thereby preserving the necessary context for accurate request identification and preventing the cross-origin confusion that leads to data leakage and authentication bypasses until such time as a full upgrade can be performed in production environments.