Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-120474 Details

Description

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the redirect interceptor and a shared response cache are used together, an authenticated request that is redirected to a same-origin target has the final response stored under the original request's cache key. That key omits the credential and carries no Vary header, so a later anonymous or different user can be served the first user's private response body. This results in cross-user disclosure of cached private responses. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: openjsCVSS-B:6.5 MEDIUMVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://cna.openjsf.org/security-advisories.html	openjs
https://github.com/nodejs/undici/security/advisories/GHSA-7xg3-fphp-28hg	openjs

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-524	Use of Cache Containing Sensitive Information	openjs
CWE-639	Authorization Bypass Through User-Controlled Key	openjs

Affected Products

No affected product data is available for this CVE.

Change History

1 change record found show changes