DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-109829: CVE-2026-109829: Persistent Cache Poisoning and Cross-User Information Disclosure in Node.js Undici

#security #cve #cybersecurity

CVE-2026-109829: Persistent Cache Poisoning and Cross-User Information Disclosure in Node.js Undici

Vulnerability ID: CVE-2026-109829
CVSS Score: 7.4
Published: 2026-10-27

A cache key origin desynchronization and intermediate Cache-Control suppression vulnerability exists in the Node.js Undici HTTP client library. When an originless Agent composes the redirect and cache interceptors in the order compose(redirect(), cache()) with a shared cache store, cross-origin responses and sensitive redirected resources are stored under the initial request's cache key.

TL;DR

Undici versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1 fail to validate final response origins and intermediate hop Cache-Control directives when redirect() precedes cache() in an originless Agent. This enables persistent cache poisoning and cross-user sensitive data disclosure in shared caches.

⚠️ Exploit Status: POC

Technical Details

  • CVE ID: CVE-2026-109829 (GHSA-4w7w-5xrc-9h26)
  • Weakness Class: CWE-346 (Origin Validation Error) / CWE-524 (Use of Cache Containing Sensitive Information)
  • CVSS v3.1 Score: 7.4 High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
  • EPSS Score: 0.15% (4.04th Percentile)
  • Attack Vector: Network (Cross-Origin HTTP Redirects & Authenticated Redirect Chains)
  • Primary Impact: Persistent Shared Cache Poisoning & Cross-User Private Data Disclosure
  • Exploit Status: Proof-of-Concept Available (Unit Test Reproduction)
  • CISA KEV Status: Not Listed

Affected Systems

  • Node.js Undici (>= 7.0.0, < 7.30.1)
  • Node.js Undici (>= 8.0.0, < 8.12.2)
  • undici: >= 7.0.0, < 7.30.1 (Fixed in: 7.30.1)
  • undici: >= 8.0.0, < 8.12.2 (Fixed in: 8.12.2)

Code Analysis

Commit: 26c2bfb

Primary fix commit verifying terminal response origin against cacheKey origin, tracking intermediate hop Cache-Control directives via kRedirectCacheControl, and preserving redirect history context in DeduplicationHandler.

Commit: b20b82a

Cherry-pick backport commit for Undici 7.30.1.

Mitigation Strategies

  • Upgrade Undici to patched versions (7.30.1 or 8.12.2) that validate terminal origins against cache keys and enforce intermediate hop Cache-Control directives.
  • Reorder interceptor composition so that interceptors.cache() is registered before interceptors.redirect().
  • Avoid combining originless Agent dispatchers with shared cache stores (type: 'shared') when automatic redirection is enabled.
  • Use per-origin Pool or Client instances or configure cache interceptors with type: 'private' for user-specific requests.

Remediation Steps:

  1. Audit project dependencies using 'npm list undici', 'yarn why undici', or 'pnpm why undici' to identify versions in the ranges >= 7.0.0 < 7.30.1 or >= 8.0.0 < 8.12.2.
  2. Search application source code for Agent instances composing redirect() before cache() with shared cache stores.
  3. Update package.json to require undici ^7.30.1 or ^8.12.2 and regenerate lockfiles.
  4. If immediate patching is not possible, invert the interceptor order to compose(cache(), redirect()) and redeploy affected services.

References

Read the full report for CVE-2026-109829 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)