CVE-2026-116630: undici cache poisoning via cross-origin redirect revalidation

CVE-2026-116630 · Severity: medium · CVSS 5.9 · Published 2026-11-06

undici is an HTTP client library for Node.js that handles web requests and caching. When configured with certain interceptor combinations, the library can be tricked into serving cached responses—including those protected by authentication—to unauthorized users by exploiting how it handles redirects across different origins. An attacker who controls a cross-origin redirect can access sensitive cached data like authenticated API responses.

Quick answers

Is CVE-2026-116630 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-116630 being exploited in the wild.
How severe is CVE-2026-116630?
Medium severity, with a CVSS score of 5.9, published 6 November 2026.
Which products and versions are affected?
Node.js Undici 7.0.0 through 7.30.1, 8.0.0 through 8.12.3.
Is there a fix for CVE-2026-116630?
Yes: fixed in 7.30.2, 8.12.4. Until then: Compose the interceptors as cache then redirect instead of redirect then cache, use per-origin dispatchers and cache stores, or disable shared caching on requests that support redirects. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116630 attacked?
It is attacked over the network.
Am I affected by CVE-2026-116630?
Check whether you run Node.js Undici at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 7.30.2, 8.12.4

Compose the interceptors as cache then redirect instead of redirect then cache, use per-origin dispatchers and cache stores, or disable shared caching on requests that support redirects.

Technical details

A cache poisoning vulnerability occurs when the redirect interceptor strips origin-bound headers (like Authorization) but leaves cache-generated validators (If-None-Match, If-Modified-Since) intact during cross-origin redirects. This causes the destination origin's 304 Not Modified response to be treated as valid revalidation of the original origin's cached data, allowing a shared cache to serve authenticated responses to unauthenticated callers. The issue affects versions using compose(redirect(), cache()) with a shared cache store; the reverse order compose(cache(), redirect()) is not vulnerable.

Affected products

  • Node.js undici 7.0.0 through 7.30.1, 8.0.0 through 8.12.3

Timeline

  • 2026-11-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.