← Terug naar overzicht

A critical vulnerability in undici versions 8.10.0 through 8.10.2 omits the destination origin from cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. The internal cache key falls back to an empty origin string, causing cached responses from one upstream origin to be returned for requests to a different trusted origin when method, path, and headers match. This enables cross-origin information disclosure and persistent cache poisoning. A demonstrated exploit showed full authentication bypass where a JWT signed with an attacker-controlled key was accepted as belonging to a trusted issuer without ever contacting the trusted origin. The vulnerability is a regression introduced in version 8.10.0 and does not affect applications using an Agent. Users are advised to upgrade to undici 8.10.3 or later to remediate the issue.

Affected products

  • undici 8.10.0
  • undici 8.10.1
  • undici 8.10.2

Related CVE's

  • CVE-2026-85152

Categories

  • Identity & Access
  • Supply Chain & Dependencies
  • Web Technologies