nodejs undici up to 7.30.1/8.12.3 Cache Interceptor redirect

Summaryinfo

A vulnerability was found in nodejs undici up to 7.30.1/8.12.3. It has been rated as problematic. This issue affects some unknown processing of the component Cache Interceptor. This manipulation causes redirect. The identification of this vulnerability is CVE-2026-116592. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in nodejs undici up to 7.30.1/8.12.3. It has been declared as problematic. Affected by this vulnerability is an unknown function of the component Cache Interceptor. The manipulation with an unknown input leads to a redirect vulnerability. The CWE definition for the vulnerability is CWE-601. The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. As an impact it is known to affect integrity. The summary by CVE is:

undici is an HTTP client for Node.js. In versions 7.30.1 and 8.12.2 through 8.12.3, when an originless Agent composes the redirect and shared cache interceptors, undici decides whether to store the final response under the original request key by inspecting only the final redirect hop, which bypasses the earlier fix for CVE-2026-109829 that compared only the initial and final origins. A redirect that bounces through an untrusted origin and returns to the trusted origin is still cached under the trusted key, an intermediate hop's Vary is dropped so a response that varies on Authorization or Cookie can be served to a different user, and an intermediate hop's no-cache or default-uncacheable status is ignored so a non-storable redirect is laundered into a cacheable entry. An attacker who controls a redirect target from a trusted URL can poison the cached entry for that URL or have a private, per-user response served to a later caller. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, compose the interceptors as cache then redirect, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-116592 since 10/26/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1204.001 for this issue.

Upgrading to version 7.30.2 or 8.12.4 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• nodejs

Name

• undici

Version

• 7.30.0
• 7.30.1
• 8.12.0
• 8.12.1
• 8.12.2
• 8.12.3

Website

• Product: https://github.com/nodejs/undici/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion