Node.js undici: Cache poisoning via cross-origin redirects
Summary
undici, the HTTP client library for Node.js, can store a response produced after a cross-origin redirect under the original trusted URL when an originless Agent, a shared cache store and the composition compose(redirect(), cache()) are all used. An attacker who controls the redirect target can poison the shared cache, so later callers receive the attacker's content without either origin being contacted. A private, no-store redirect response to a user-specific resource can also be cached and served to an unauthenticated caller, which discloses private data.
Affected
- undici 7.0.0 up to but not including 7.30.1
- undici 8.0.0 up to but not including 8.12.2
- Only applications that combine an originless Agent, a shared MemoryCacheStore or SqliteCacheStore, and compose(redirect(), cache()) are affected.
- Origin-bound Client and Pool dispatchers and compose(cache(), redirect()) are not affected.
Fixed in
- 7.30.1
- 8.12.2
Workaround
- Compose the interceptors as compose(cache(), redirect()).
- Use per-origin dispatchers and cache stores.
- Disable shared caching on redirect-capable requests.
Exploitation
- Not known to be exploited in the wild.
- Not listed in CISA KEV at the time of research; CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept found.
Our recommendation
- Check lockfiles and build pipelines for undici (for example with npm ls undici), including transitive copies.
- Update to 7.30.1 or 8.12.2 or later; use overrides where a parent package pins an older version.
- If you run a Node.js service with outbound requests and a shared cache, review the Agent and interceptor setup, and apply the workarounds if patching is delayed.
- Confirm the NVD CVSS score: the CVE record shows 9.1, while secondary sources show 7.4 (AC:H).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- OpenJS CNA Security Advisories cna.openjsf.org
- GitHub Security Advisory GHSA-4w7w-5xrc-9h26 github.com
- OSV: GHSA-4w7w-5xrc-9h26 osv.dev
- GitLab Advisory Database: CVE-2026-109829 advisories.gitlab.com
- undici releases github.com
- Debian Security Tracker: CVE-2026-109829 security-tracker.debian.org
- Mend: CVE-2026-109829 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:31.
Original description (NVD)
undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handler changes the origin, so a response produced after a cross-origin redirect is stored under the original key. An attacker who controls the target of a redirect from a trusted URL can have their response cached under that trusted URL and served to later callers, allowing persistent cache poisoning, and the same key confusion lets a private, non-stored redirect response to a user-specific resource be stored under the original URL and served to a later unauthenticated caller, disclosing private data. Applications are affected only when an originless Agent, a shared cache store, and the redirect-then-cache composition are all used. The issue is fixed in undici 7.30.1 and 8.12.2, which verify the producing origin still matches the cache key and preserve each redirect hop's cache-control policy before storing, and users should upgrade to one of those versions or later. As a workaround, compose the cache interceptor before the redirect interceptor, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.