Undici 8.12.4 and 7.30.2: Fixes Redirect Cache Poisoning

Shared Caches Storing Redirect Responses Under the Original Key #

CVE-2026-116592 concerns where a redirect chain's final response is stored. Per the Undici v8.12.4 release notes, the affected 8.x releases cached that response under the original request key without applying the origin, cache policy, freshness, or Vary requirements of every intermediate hop. The CVE-2026-116592 record narrows the trigger to an originless Agent that composes the redirect and shared cache interceptors, where the store decision looked only at the final hop. A redirect that bounces through an untrusted origin and returns to the trusted one was therefore cached under the trusted key.

The record adds two further effects: an intermediate hop's Vary is dropped, so a response that varies on Authorization or Cookie can reach a different user, and an intermediate hop's no-cache or default-uncacheable status is ignored. The record says this bypassed the earlier fix for CVE-2026-109829, which compared only the initial and final origins. This suggests that earlier check covered only the endpoints of the chain. High severity, CVSS 7.4 applies to the whole chain, not only the last hop.

The fix, described in the Undici v7.30.2 release notes and the Undici v8.12.4 release notes, works on every hop instead:

validates every redirect hop, combines their Vary fields

Undici v8.12.4 release notes

The same fix limits freshness and stale serving to the most restrictive hop and invalidates persistent SQLite entries written by vulnerable releases. For SQLite-backed caches, this suggests the upgrade clears those entries without a manual step, though the notes describe no such step.

A second flaw in this group, CVE-2026-120474, involves compose(redirect(), cache()) with a same-origin redirect. The CVE-2026-120474 record says the final response was stored under the original request's key, which omits the credential and carries no Vary header, so a later anonymous or different user could receive the first user's private body. The 8.12.4 fix stops storing redirected requests that carry Authorization, Cookie, or Proxy-Authorization under the original alias key. This is rated medium, CVSS 6.5 (MEDIUM), assigned by openjs.

Revalidation Accepting a 304 From a Different Origin #

CVE-2026-116630 affects cached responses that are revalidated with a conditional request. When the origin that stored the response redirects that revalidation to another origin, the CVE-2026-116630 record says the redirect handler strips origin-bound credential headers but not the cache-generated If-None-Match or If-Modified-Since validators. The destination's 304 is then treated as a successful revalidation of the original origin's stored representation. A shared cache can then serve that authenticated response, including one gated by Authorization, to a later unauthenticated caller.

The fix checks that the revalidation target matches the cached URL and that any returned validator matches the stored representation before the cached body is replayed, as the Undici v7.30.2 release notes describe. The record rates this medium, CVSS 5.9, assigned by openjs. Its affected ranges are from 7.0.0 before 7.30.2 and from 8.0.0 before 8.12.4.

Credential Headers in Tuple Arrays Reaching Cross-Origin Redirects #

CVE-2026-120415 is a representation-dependent bypass. The CVE-2026-120415 record says the redirect interceptor strips Authorization, Cookie, Proxy-Authorization, and Host on a cross-origin redirect, but when headers are an array of name and value tuples, it reads them as a flat list. The names never match, so the sensitive headers are kept. The record gives Object.entries as one source of that tuple form, so code that builds headers that way is in scope.

The exposure requires a header-normalizing interceptor such as cache or deduplicate composed outside the redirect interceptor, which serializes the retained headers onto the cross-origin request. The record calls this a bypass of the cross-origin stripping added in CVE-2024-30260. The fix, in the Undici v8.12.4 release notes, handles both tuple arrays and flat header arrays when removing sensitive headers. It is rated medium, CVSS 5.9.

Cache Replay Exceptions That Terminate Node.js Processes #

CVE-2026-120222 is an availability issue. A downstream handler exception raised during cache replay escaped as an uncaught exception or unhandled promise rejection and ended the process. The CVE-2026-120222 record lists the dump interceptor exceeding its maxSize, the decompress interceptor rejecting more than five Content-Encoding values, and cached-body replay after a 304. A malicious or compromised server can trigger it with a cacheable response, so the record says the impact is availability only.

The fix reports these failures as request errors instead, according to the Undici v8.12.4 release notes, which also name asynchronous cache-store failures among them. The record rates this medium, CVSS 5.9, assigned by openjs, with affected ranges from 7.0.0 before 7.30.2 and from 8.0.0 before 8.12.4.

Subresource Integrity Skipped for Whitespace-Surrounded Metadata #

CVE-2026-120423 affects fetch() when integrity metadata is separated by ASCII whitespace other than a space. The CVE-2026-120423 record says the check split on a single space, so a digest preceded by a tab became one unrecognized token and was skipped. When no recognized algorithm remained, the integrity list was treated as empty and the response was accepted. The attacker needs only to control the response body.

The fix splits integrity metadata on all ASCII whitespace before SHA-256, SHA-384, or SHA-512 verification, as stated in the Undici v7.30.2 release notes. The record rates this medium, CVSS 5.9, assigned by openjs. For the 7.x line, its affected range starts at 7.15.0, not 7.0.0.

Undici Affected and Fixed Versions #

Also in this release #

• 8.12.4 cache: ignore SQLITE_BUSY in the SQLite cache store (#6049).
• 8.12.4 HTTP/2: keep the persistent error sink on released streams (#5983), replay requests whose HEADERS raced a GOAWAY (#6065), and preserve accepted streams with deferred ids (#6090).
• 8.12.4 fetch: avoid eager reads from async iterable bodies (#5990) and preserve abort propagation after garbage collection (#6070).
• 8.12.4 mock: ignore the trailing slash before a query string (#6031) and expose aborted on the mock dispatch controller (#5964).
• 8.12.4 types and handlers: declare FormData prototype methods (#6056) and let interim 1xx responses through DecoratorHandler (#6028).
• 8.12.4 docs: origin is optional only for origin-bound dispatchers (#5994), QUERY added to retry default methods (#6062), typo fixes (#6057).
• 8.12.4 build: disable wasm SIMD on RISC-V (#6041).
• 8.12.4 dependencies: eslint 10.13.0 (#6059), neostandard 0.14.1 (#6058), cronometro 7.0.1 (#5969), @fastify/busboy 3.2.4 (#6102), undici 6.29.1 (#6103), node-forge 1.4.2 (#6134), jsondiffpatch 0.7.7 (#6140), actions/upload-artifact 7.0.2 (#6125), step-security/harden-runner 2.22.3 (#6127).
• 7.30.2 decompress: join a repeated content-encoding header (#5664, backported in #6026).
• 7.30.2 HTTP/1: backport ignoring type of service errors (#5547, backported in #6076).
• 7.30.2 CI and bodies: fix macOS WPT (Python 3.15) and job timeout on v7.x (#6087); backport extractBody fixes (#6093).

Complete lists: Undici v8.12.4 release notes and Undici v7.30.2 release notes.

Upgrade checklist #

1. Find your line in the table. If you run 8.x, upgrade to 8.12.4. If you run 7.x, upgrade to 7.30.2, per the Undici v7.30.2 release notes.

2. If you cannot upgrade yet, apply the workaround from the matching record. For CVE-2026-116592 and CVE-2026-116630, compose the cache interceptor before the redirect interceptor, as the CVE-2026-116592 record states:

   JavaScriptCopy

   compose(cache(), redirect())

   The same records also suggest per-origin dispatchers and cache stores, or disabling shared caching on redirect-capable requests.

3. For CVE-2026-120415, pass request headers as a plain object or a flat name and value array instead of an array of tuples, as the CVE-2026-120415 record says. For CVE-2026-120222, avoid composing the cache interceptor with a response handler that throws during processing.

4. For CVE-2026-120423, write SRI integrity values without surrounding whitespace and separate multiple digests with a single space, as the CVE-2026-120423 record advises. The CVE-2026-120474 record gives no workaround, so for that flaw the upgrade is the only path.

Checking Whether Your Code Uses redirect() and cache() #

Start by searching the project for the composition that CVE-2026-120474 names. The command below lists lines calling compose( in JavaScript and TypeScript files, and you should look for redirect() and cache() in the same call.

grep -rn "compose(" --include="*.js" --include="*.ts" --include="*.mjs" .
grep -rn "integrity" --include="*.js" --include="*.ts" --include="*.mjs" .

Compare the undici version your project resolves with the table above. A match on compose(redirect(), cache()) places the project in the scope of CVE-2026-120474 and CVE-2026-116592, and the second search shows where SRI values are pinned for CVE-2026-120423.