Undici patches a cache-poisoning bug in Node's fetch client

Undici, the HTTP client that powers Node.js’s built-in fetch, has patched two security bugs disclosed this week. The more serious, CVE-2026-116592 (CVSS 7.4), is a cache-poisoning flaw: when an app composes undici’s redirect and shared-cache interceptors on an originless Agent, undici checks only the final redirect hop’s origin before caching the response. An attacker who controls a redirect target reachable from a trusted URL can poison that cache entry, or have a private, per-user response served back to an unrelated caller.

A second bug, CVE-2026-120415 (CVSS 5.9), leaks credentials rather than content. If request headers are passed as an array of name/value tuples, a documented and valid input, alongside a normalising interceptor such as cache or dedupe, undici’s redirect handler misreads the tuples as a flat list, so headers like Authorization and Cookie never get stripped before the request follows a cross-origin redirect.

Both are fixed in undici 7.30.2 and 8.12.4. Since undici ships inside Node.js itself as the engine behind global fetch, this reaches every app using it, not just the ones that installed the package directly.

// vulnerable: checks only the last redirect's origin
dispatcher.compose(redirect(), cache())

// fixed order, per the advisory
dispatcher.compose(cache(), redirect())

Why it matters: if your Node app follows redirects through a shared cache, or builds fetch headers as a tuple array, update now. The workaround if you can’t upgrade immediately is the interceptor reordering above, or passing headers as a plain object instead of tuples.