CVE-2026-120474: undici cross-user cache disclosure via same-origin redirect

CVE-2026-120474 · Severity: medium · CVSS 6.5 · Published 2026-11-06

undici is an HTTP client library for Node.js applications. When using certain interceptor configurations with shared caching, an authenticated user's private response can be cached and later served to other users requesting the same URL, exposing sensitive personal data. This occurs because the cache key does not properly account for authentication credentials when a request is redirected on the same origin.

Technologies: OpenJS Foundation Undici. Vendors: OpenJS Foundation.

Quick answers

Is CVE-2026-120474 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-120474 being exploited in the wild.
How severe is CVE-2026-120474?
Medium severity, with a CVSS score of 6.5, published 6 November 2026.
Which products and versions are affected?
OpenJS Foundation Undici 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3.
Is there a fix for CVE-2026-120474?
Yes: fixed in undici 7.30.2, 8.12.4. Until then: Compose the interceptors as compose(cache(), redirect()) instead of compose(redirect(), cache()); use per-origin dispatchers and cache stores; or disable shared caching on credential-bearing redirect-capable requests. Per-user responses should set Vary, private, or no-store cache headers. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120474 attacked?
It is attacked over the network.
Am I affected by CVE-2026-120474?
Check whether you run OpenJS Foundation Undici at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: undici 7.30.2, 8.12.4

Compose the interceptors as compose(cache(), redirect()) instead of compose(redirect(), cache()); use per-origin dispatchers and cache stores; or disable shared caching on credential-bearing redirect-capable requests. Per-user responses should set Vary, private, or no-store cache headers.

Technical details

The vulnerability arises when the redirect and cache interceptors are composed as compose(redirect(), cache()) with a shared cache store. The cache builds its key from the original request before the redirect handler changes the path, so a credential-bearing request redirected to a same-origin target has its final response stored under the original request's key, which omits the credential and carries no Vary header. A subsequent unauthenticated or differently authenticated request is then served the first user's private response body from the shared cache.

Affected products

  • OpenJS Foundation undici 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3

Timeline

  • 2026-11-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.