# CVE-2026-120474: undici cross-user cache disclosure via same-origin redirect

Source: https://junglewise.ai/threats/cve-2026-120474-undici-is-an-http-client-for-node-js-in-versions-7-0-0-through-7  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-120474 · Severity: medium · CVSS 6.5 · Published 2026-11-06

undici is an HTTP client library for Node.js applications. When using certain interceptor configurations with shared caching, an authenticated user's private response can be cached and later served to other users requesting the same URL, exposing sensitive personal data. This occurs because the cache key does not properly account for authentication credentials when a request is redirected on the same origin.

Technologies: [OpenJS Foundation Undici](https://junglewise.ai/threats/technologies/openjs-foundation-undici). Vendors: [OpenJS Foundation](https://junglewise.ai/threats/vendors/openjs-foundation).

## Quick answers

**Is CVE-2026-120474 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120474 being exploited in the wild.

**How severe is CVE-2026-120474?** Medium severity, with a CVSS score of 6.5, published 6 November 2026.

**Which products and versions are affected?** OpenJS Foundation Undici 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3.

**Is there a fix for CVE-2026-120474?** Yes: fixed in undici 7.30.2, 8.12.4. Until then: Compose the interceptors as compose(cache(), redirect()) instead of compose(redirect(), cache()); use per-origin dispatchers and cache stores; or disable shared caching on credential-bearing redirect-capable requests. Per-user responses should set Vary, private, or no-store cache headers. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120474 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-120474?** Check whether you run OpenJS Foundation Undici at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in undici 7.30.2, 8.12.4

Compose the interceptors as compose(cache(), redirect()) instead of compose(redirect(), cache()); use per-origin dispatchers and cache stores; or disable shared caching on credential-bearing redirect-capable requests. Per-user responses should set Vary, private, or no-store cache headers.

## Technical details

The vulnerability arises when the redirect and cache interceptors are composed as compose(redirect(), cache()) with a shared cache store. The cache builds its key from the original request before the redirect handler changes the path, so a credential-bearing request redirected to a same-origin target has its final response stored under the original request's key, which omits the credential and carries no Vary header. A subsequent unauthenticated or differently authenticated request is then served the first user's private response body from the shared cache.

## Affected products

- OpenJS Foundation undici 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3

## Timeline

- 2026-11-06: disclosed

## References

- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
- [https://github.com/nodejs/undici/security/advisories/GHSA-7xg3-fphp-28hg](https://github.com/nodejs/undici/security/advisories/GHSA-7xg3-fphp-28hg)

## Related threats

- [undici Subresource Integrity bypass via whitespace in integrity metadata](https://junglewise.ai/threats/cve-2026-120423-undici-is-an-http-client-for-node-js-in-versions-7-15-0-through)
- [undici denial of service via unhandled exception in cache-interceptor](https://junglewise.ai/threats/cve-2026-120222-undici-is-an-http-client-for-node-js-in-versions-7-0-0-through-7)
- [undici cache poisoning and cross-user disclosure via intermediate redirect](https://junglewise.ai/threats/cve-2026-116592-undici-is-an-http-client-for-node-js-in-versions-7-30-1-and-8-12)
- [undici HTTP client denial of service in decompress interceptor](https://junglewise.ai/threats/cve-2026-87029-undici-is-an-http-client-library-for-node-js-in-versions-7-15-0)
- [undici denial of service via TLS 1.2 certificate renegotiation](https://junglewise.ai/threats/cve-2026-87018-undici-is-an-http-client-library-for-node-js-in-versions-4-2-1)