# CVE-2026-120222: undici denial of service via unhandled exception in cache-interceptor

Source: https://junglewise.ai/threats/cve-2026-120222-undici-is-an-http-client-for-node-js-in-versions-7-0-0-through-7  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-120222 · Severity: medium · CVSS 5.9 · Published 2026-11-06

undici is an HTTP client library for Node.js that applications use to fetch data from servers. When the cache interceptor is combined with response handlers that validate limits (like maximum response size), a malicious server can send a specially crafted cached response that causes an unhandled exception, crashing the Node.js process and causing an application outage.

Technologies: [OpenJS Foundation Undici](https://junglewise.ai/threats/technologies/openjs-foundation-undici). Vendors: [OpenJS Foundation](https://junglewise.ai/threats/vendors/openjs-foundation).

## Quick answers

**Is CVE-2026-120222 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120222 being exploited in the wild.

**How severe is CVE-2026-120222?** Medium severity, with a CVSS score of 5.9, published 6 November 2026.

**Which products and versions are affected?** OpenJS Foundation Undici 7.0.0 through 7.30.1, 8.0.0 through 8.12.3.

**Is there a fix for CVE-2026-120222?** Yes: fixed in undici 7.30.2, 8.12.4. Until then: Avoid composing the cache interceptor with a response handler that throws during response processing (such as dump with a maxSize limit) until upgrading. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120222 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-120222?** Check whether you run OpenJS Foundation Undici at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in undici 7.30.2, 8.12.4

Avoid composing the cache interceptor with a response handler that throws during response processing (such as dump with a maxSize limit) until upgrading.

## Technical details

The cache interceptor replays stored responses through a Readable stream but fails to catch asynchronous exceptions thrown by downstream handlers during cache-replay callbacks or during promise-based cache lookups. A downstream handler designed to throw (such as the dump interceptor on maxSize exceeded or decompress interceptor on excessive Content-Encoding values) escapes as an uncaught exception or unhandled promise rejection. An attacker can trigger this by serving a cacheable response that causes the throw on replay, including via 304 revalidation of stale entries.

## Affected products

- OpenJS Foundation undici 7.0.0 through 7.30.1, 8.0.0 through 8.12.3

## Timeline

- 2026-11-06: disclosed

## References

- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
- [https://github.com/nodejs/undici/security/advisories/GHSA-3g9m-rv3r-w5w2](https://github.com/nodejs/undici/security/advisories/GHSA-3g9m-rv3r-w5w2)

## Related threats

- [undici cross-user cache disclosure via same-origin redirect](https://junglewise.ai/threats/cve-2026-120474-undici-is-an-http-client-for-node-js-in-versions-7-0-0-through-7)
- [undici Subresource Integrity bypass via whitespace in integrity metadata](https://junglewise.ai/threats/cve-2026-120423-undici-is-an-http-client-for-node-js-in-versions-7-15-0-through)
- [undici cache poisoning and cross-user disclosure via intermediate redirect](https://junglewise.ai/threats/cve-2026-116592-undici-is-an-http-client-for-node-js-in-versions-7-30-1-and-8-12)
- [undici HTTP client denial of service in decompress interceptor](https://junglewise.ai/threats/cve-2026-87029-undici-is-an-http-client-library-for-node-js-in-versions-7-15-0)
- [undici denial of service via TLS 1.2 certificate renegotiation](https://junglewise.ai/threats/cve-2026-87018-undici-is-an-http-client-library-for-node-js-in-versions-4-2-1)