CVE-2026-120474 Affecting node-undici package, versions *
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-ECHOLATEST-NODEUNDICI-22283331
- published8 Nov 2026
- disclosed6 Nov 2026
Introduced: 6 Nov 2026
NewCVE-2026-120474 (opens in a new tab)How to fix?
There is no fixed version for Echo:latest node-undici.
NVD Description
Note: Versions mentioned in the description apply only to the upstream node-undici package and not the node-undici package as distributed by Echo.
See How to fix? for Echo:latest relevant fixed versions and status.
undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the redirect interceptor and a shared response cache are used together, an authenticated request that is redirected to a same-origin target has the final response stored under the original request's cache key. That key omits the credential and carries no Vary header, so a later anonymous or different user can be served the first user's private response body. This results in cross-user disclosure of cached private responses. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later.