---
id: CVE-2026-120474
title: undici vulnerable to cross-user cache disclosure via same-origin redirect
summary: >-
  undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and
  8.0.0 through 8.12.3, when the redirect interceptor and a shared response
  cache are used together, an authenticated request that is redirected to a
  same-origin ta…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-524
  - CWE-639
vendor: undici
product: undici
affected:
  - undici >= 7.0.0 < 7.30.2
  - undici >= 8.0.0 < 8.12.4
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T09:57:46.664Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120474'
references:
  - url: 'https://github.com/nodejs/undici/security/advisories/GHSA-7xg3-fphp-28hg'
  - url: 'https://cna.openjsf.org/security-advisories.html'
tags:
  - cve.org
ingestedAt: '2026-11-06T10:49:35.397Z'
epss: 0.00288
epssPercentile: 0.21427
---

## Overview

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the redirect interceptor and a shared response cache are used together, an authenticated request that is redirected to a same-origin target has the final response stored under the original request's cache key. That key omits the credential and carries no Vary header, so a later anonymous or different user can be served the first user's private response body. This results in cross-user disclosure of cached private responses. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later.

## Affected

- `undici >= 7.0.0 < 7.30.2`
- `undici >= 8.0.0 < 8.12.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.