Executive brief
undici is a widely-used HTTP client library for Node.js. Versions 8.10.0 through 8.10.1 have a flaw where the cache and request-deduplication interceptors omit the destination origin from their cache keys, allowing responses from one upstream server to be served for requests to a different server. An attacker controlling one origin can inject poisoned responses that get cached and replayed for requests to trusted origins, enabling account takeover (e.g., via JWT signing attacks) and persistent data theft.
Technical details
The cache() and deduplicate() interceptors in undici 8.10.0 build cache and deduplication keys without including the destination origin when a dispatcher does not carry a single authoritative origin or when a request supplies its own origin. This causes otherwise-identical requests to different origins to be keyed together in a shared cache store. An attacker who controls a response from one origin can have that response returned for requests to a different trusted origin when method, path, and headers match. Applications sharing interceptor instances across multiple origins are affected; Agent-based dispatchers are not affected because they include origin in dispatch options. Fix available: upgrade to undici 8.10.2.
Affected products
- OpenJS Foundation undici 8.10.0 through 8.10.1
Timeline
- 2026-09-04: disclosed
- 2026-09-04: patched: undici 8.10.2 released